Alarm on change of state

I want to get only 1 warning when a regularly written log record in my system stops writing and starts writing again. I could not do this using Event Definitions.
Do you have an alternative suggestion?

Graylog 5.0.13
(Eclipse Adoptium 17.0.8 on Linux 5.4.0-169-generic)

You would really need correlation alerts to do this, that is an enterprise only feature, but it is in the free version of enterprise if you qualify for that.

Thank you for your reply. But i would like to something ask. Is the licence for densities under 2gb a full licence package with every feature?

Under 2GB a day you get all the features of Graylog Operations, but you do get Graylog Illuminate.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.