I want to configure an alert based on agreggation message and content condition.
%source% %source_ip% %message%
<sourceA> <source_ip1> <message1> <sourceA> <source_ip2> <message1> <sourceB> <source_ip1> <message1> <sourceC> <source_ip1> <message1> <sourceF> <source_ip1> <message3>
Stream “test” rules: (OK)
- if message1 match, index in this stream
Now I want to create an alert based on “message count alert condition” with “search query” option (Graylog 2.5):
Alert “Alert_streamTest” condition wanted:
If the log trigger the 5 entries Threshold in 1 minute Time Range with the same source_ip value field, create alert.
Is it possible with search query to check the value on field “source_ip” to match if the value is the same ?
If is not possible with this solution, is it possible with graylog to create this type of alert with other method ?