Narrow Logify PRO Alerts By Event And Severity

Q: How do I stop routine edits from triggering alerts?

Uncheck the low-value categories in Send For Event Types for that destination, or raise its Minimum Severity above the level those events use. For example, leaving Post unchecked stops content edits from alerting, and setting the threshold to High (500+) filters out most routine activity while keeping failed logins and security events flowing.

Q: Can each destination have different filters?

Yes. Send For Event Types, Minimum Severity, and Rate Limit (seconds) are configured separately in every destination's section on the Notifications tab. You can send only critical security events to Email, high-severity events to Slack, and every event to a webhook for archiving — all on the same site at the same time.

Q: What does the rate limit actually do?

Rate Limit (seconds) enforces a minimum gap between notifications to one destination. If matching events occur inside that window, only the first is sent and the rest are suppressed until the window passes. The default is 60 seconds. Set it to 0 to disable rate limiting when you need every matching event delivered, such as to a webhook feeding a SIEM.

Q: Which severity should I use for security alerts?

For a security-focused destination, set Minimum Severity to High (500+) or Critical (600+). Failed logins are scored 500 (High), and Logify raises an aggregated brute-force event when repeated failures cross the threshold, so a High minimum surfaces both without pulling in lower-severity routine activity. Pair it with the Security and User event types for the tightest security feed.

When every logged event triggers a notification, the alerts you actually care about get buried and your team starts ignoring them. Logify PRO gives each notification destination its own three filters — Send For Event Types, Minimum Severity, and Rate Limit (seconds) — so Slack, Email, a webhook, and Syslog can each receive only the activity that matters to them. This page shows how to tune those filters to cut noise without missing critical events.

PRO feature

Per-destination alert filtering is part of Logify PRO's real-time Notifications. The free plugin has no live alerting to filter — it ships only the scheduled Email Digest. Upgrade at kaizencoders.com/logify.

What are per-destination alert filters?

Per-destination filters are the three settings attached to each notification destination that decide whether a given event is sent to that destination. Because they live on the destination — not globally — you can set different rules for Email, Slack, Generic Webhook, and Syslog on the same site.

Filter	Default	What it controls
Send For Event Types	All	Which categories of activity are eligible (user, security, post, plugin, and so on).
Minimum Severity	Warning (300)	The lowest severity that is allowed through.
Rate Limit (seconds)	60	How often the destination may fire, to stop repeat floods.

Open a destination's filters

Go to Logify → Settings → Notifications and expand the section for the destination you want to tune — Email, Slack, Generic Webhook, or Syslog (UDP). The three filters appear under that destination's connection fields.

Narrow Logify Filters

Choose which event types to send

In Send For Event Types, check only the categories that should reach this destination. Leave every box unchecked to send all event types. The available categories are:

User, Security, Post, Attachment, Comment, Plugin, Theme, Term / Taxonomy, Nav Menu, Widget, and Setting / Option.

For a security-focused Slack channel, you might check only Security and User so login failures and role changes come through while routine content edits stay out. For the full list of what each category records, see the event reference.

Set a minimum severity

In Minimum Severity, choose the lowest severity Logify should send to this destination. Only events at or above the chosen level trigger it. Logify scores every event on this scale:

Severity	Value	Typical events
Info	100	Routine, low-risk activity
Notice	200	Normal but noteworthy changes
Warning	300	Changes worth reviewing (default threshold)
Alert	400	Events that need attention
High	500	Failed logins and elevated-risk activity
Critical	600	Serious security or configuration events
Emergency	700	The most severe events

Choose Any severity (0) to send everything, or raise the threshold — for example to High (500+) — so only failed logins, brute-force bursts, and more severe events reach that destination.

Apply rate limiting

Rate Limit (seconds) sets the minimum gap between sends to that destination, which prevents a repeating event from flooding it. The default is 60 seconds; set 0 to disable rate limiting entirely. Rate limiting is most useful for chatty destinations such as Slack, where a burst of the same event would otherwise post dozens of times in a row.

Save each destination separately

These filters are per-destination, so repeat the process for every destination that needs different behavior. A common setup is:

Slack — Security event types only, Minimum Severity High (500+), rate limit 60s.
Email — Security and User, Minimum Severity Critical (600+), rate limit 0.
Generic Webhook — all event types, Any severity, so an external system keeps a complete record.

Save the Notifications tab after adjusting each section.

Conclusion

Filtering by event type, severity, and rate limit is what keeps Logify PRO alerts trustworthy — a signal your team acts on rather than noise it mutes. Start narrow, sending only your highest-severity events, then loosen the filters only if you find you need more detail. To set up the destinations themselves, see how Logify PRO sends real-time alerts.

FAQs

How do I stop routine edits from triggering alerts?

Uncheck the low-value categories in Send For Event Types for that destination, or raise its Minimum Severity above the level those events use. For example, leaving Post unchecked stops content edits from alerting, and setting the threshold to High (500+) filters out most routine activity while keeping failed logins and security events flowing.

What does the Minimum Severity default of 300 mean?

A default of 300 means the destination only fires for events scored Warning or higher, so Info (100) and Notice (200) events are skipped. Logify's scale runs Info 100, Notice 200, Warning 300, Alert 400, High 500, Critical 600, and Emergency 700. Lower the threshold to "Any severity" to catch everything, or raise it to send only the most serious events.

Can each destination have different filters?

Yes. Send For Event Types, Minimum Severity, and Rate Limit (seconds) are configured separately in every destination's section on the Notifications tab. You can send only critical security events to Email, high-severity events to Slack, and every event to a webhook for archiving — all on the same site at the same time.

What does the rate limit actually do?

Rate Limit (seconds) enforces a minimum gap between notifications to one destination. If matching events occur inside that window, only the first is sent and the rest are suppressed until the window passes. The default is 60 seconds. Set it to 0 to disable rate limiting when you need every matching event delivered, such as to a webhook feeding a SIEM.

Which severity should I use for security alerts?

For a security-focused destination, set Minimum Severity to High (500+) or Critical (600+). Failed logins are scored 500 (High), and Logify raises an aggregated brute-force event when repeated failures cross the threshold, so a High minimum surfaces both without pulling in lower-severity routine activity. Pair it with the Security and User event types for the tightest security feed.