# Combine series data into single alert instead of generating alert for each individual series

**URL:** https://community.influxdata.com/t/combine-series-data-into-single-alert-instead-of-generating-alert-for-each-individual-series/6362
**Category:** Kapacitor
**Tags:** kapacitor
**Created:** [August 24, 2018, 4:51pm UTC](https://community.influxdata.com/t/combine-series-data-into-single-alert-instead-of-generating-alert-for-each-individual-series/6362 "2018-08-24T16:51:20Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![stanislav-zaprudskiy](https://avatars.discourse-cdn.com/v4/letter/s/f17d59/32.png) [@stanislav-zaprudskiy](https://community.influxdata.com/u/stanislav-zaprudskiy)
#### Post date: [August 24, 2018, 4:51pm UTC](https://community.influxdata.com/t/combine-series-data-into-single-alert-instead-of-generating-alert-for-each-individual-series/6362/1 "2018-08-24T16:51:20Z")

</div>

In my simple rule what I do I alert having found some points for which `lambda:` evaluates to true:

```auto
var data = stream
    |from()
        .measurement(measurement)
        .where(lambda: "organization" =~ where_organization)
        .where(lambda: "project" =~ where_project)
        .where(lambda: "build_server" == 'build.host.corp')
        .groupBy(groups)

data
    |window()
        .period(window_period)
        .every(window_every)
        .align()
    |alert()
        .crit(lambda: "status_code" <= 0)

```

The data caught by `alert()` node would look like the following in my case:

```auto
{
  "series": [
    {
      "name": "measurement",
      "tags": {
        "build_server": "build.host.corp",
        "host": "24511ae0f374",
        "identity": "4078e1b61",
        "status": "Idle"
      },
      "columns": [
        "time",
        "status_code"
      ],
      "values": [
        [
          "2018-08-24T16:36:18Z",
          1
        ]
      ]
    },
    {
      "name": "measurement",
      "tags": {
        "build_server": "build.host.corp",
        "host": "24511ae0f374",
        "identity": "415a60e63",
        "status": "Idle"
      },
      "columns": [
        "time",
        "status_code"
      ],
      "values": [
        [
          "2018-08-24T16:36:18Z",
          1
        ]
      ]
    },
    {
      "name": "measurement",
      "tags": {
        "build_server": "build.host.corp",
        "host": "24511ae0f374",
        "identity": "8c2337e79",
        "status": "N/a"
      },
      "columns": [
        "time",
        "status_code"
      ],
      "values": [
        [
          "2018-08-24T16:36:18Z",
          -2
        ]
      ]
    },
    {
      "name": "measurement",
      "tags": {
        "build_server": "build.host.corp",
        "host": "24511ae0f374",
        "identity": "9c1bb8cf4",
        "status": "N/a"
      },
      "columns": [
        "time",
        "status_code"
      ],
      "values": [
        [
          "2018-08-24T16:36:18Z",
          -2
        ]
      ]
    }
  ]
}

```

Where each `series` represents a separate server reported its state within the `window()` specified, grouped by tags - so to be able to read the tags values in `.message()` method further on.

And with such data as above I receive 2 alerts - one for each server where `status_code = -2`. What I’d prefer instead is to get 1 alert having the information about 2 servers above. How can I achieve that?