Issue in producing alert for log message aggregation count

[diptopol]

I am new to elastalert2. What I am trying to accomplish here is that send a summarized email for the day where I will show all error log messages if that particular log message occurs more than 10 times. I want to show the log message and the number of occurrences in a tabular view as email content. So far I have accomplished to send error logs with its aggregated count based on log message. Here is the rule file content.

name: Error Log Summary
type: frequency
index: error-logs-*

num_events: 1

# the period of time. I will change to 24 hours later on. 
timeframe:
  minutes: 10

# this filter determine the error log
filter:
- term:
    level.keyword: 'ERROR'

alert:
- "email"
email:
- "[email protected]"
realert:
  minutes: 0

# the period of time. I will change to 24 hours later on.
aggregation:
  minutes: 10

# roo_cause is the log message based on which I want to count
aggregation_key: 'root_cause.keyword'

# my assumption was that min_doc_count will work as limiter for sending the alert
min_doc_count: 10

summary_table_type: html
email_format: html

summary_table_fields:
  - "root_cause.keyword"
  - "count"

alert_text_type: aggregation_summary_only

However, min_doc_count is not restricting any alert if the number occurrences is less than 10. So, what approach I should take to solve my problem.

[jertel]

To accomplish this:

show all error log messages if that particular log message occurs more than 10 times

You would change num_events to 10 and add query_key: root_cause.keyword, which would only trigger the alert if root_cause had at least 10 identical values within a 10 minute timeframe.

min_doc_count is only used for spike and metric aggregation rule types, not for frequency rule types.

[diptopol]

I also want to show the number of occurrences of that root_cause in the summary table. Is there any field which will show the count based on query_key: root_cause.keyword. How can I show the number of occurrences?

[diptopol]

I could not find the total count. Instead I have used aggregation period to count the number of instances where num_events equals to 10.