remove timestamp, it seems it's not present for all messages?

Also restrict to 200 rows to prevent unreasonable large emails...

config/sysalert.ini

@@ -29,3 +29,10 @@ alert_method=sysalert.email
 #mail_to=root <root@localhost>
 smtp_host=localhost
 
+# Specific services can have their own configuration
+# If you have an unstable service that sometimes fails three times
+# before it recovers you can override max_failures for this service
+# by adding a section named after that service:
+#
+#[unstable.service]
+#max_failures=3

src/sysalert/email.py

@@ -50,7 +50,11 @@ def failure(name, failures, config):
     reader.add_match(MONITOR_INVOCATION_ID=latest_inv_id)
     reader.add_disjunction()
     reader.add_match(_SYSTEMD_INVOCATION_ID=latest_inv_id)
-    journal_txt = "\n".join([entry['MESSAGE'] for entry in reader])
+    journal_txt = "\n".join(
+            [
+                entry["MESSAGE"]
+                for entry in list(reader)[-200:]
+            ])
 
     if nr_failures <= 1:
         subject=f"{hostname} - {name}: failure"