Alert and events systems from v 3.1

Hello,

I love the new alert system, which is way better than the old one, except the following points :

filter and aggregation : can I look for values between a maximum and a minimum ?
documentation : is it really up to date ?
notifications : how can i get a list of the usable variables in a template ? For instance : ${stream_url} doesn’t get me anything in

--- [Event Definition] ---------------------------
Title:                ${event_definition_title}
Description:          ${event_definition_description}
Type:                 ${event_definition_type}

--- [Stream] ---------------------------
Stream ID:            ${stream.id}
Stream:               ${stream_name}
${if stream_url}Stream Url: ${stream_url}${end}

--- [Event] --------------------------------------
Timestamp:            ${event.timestamp}
Message:              ${event.message}
Source:               ${event.source}
Key:                  ${event.key}
Priority:             ${event.priority}
Alert:                ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start:      ${event.timerange_start}
Timerange End:        ${event.timerange_end}
Fields:
${foreach event.fields field}  ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
${end}

filter and aggregation

When you can express that in a query - you can do that. Means the data must be stored as numbers and not as strings

documentation

it is not up to date currently. We are working on this and the changes should be available in the next days.

notifications

that will be part of the documentation

Thanks Jan !
Keep up the good work, Graylog is getting a really nice and mature solution.

Hello,

I’m still having an issue with notifications.

None of the variables I’m trying from the page are working.
I’m asking again because I’ve seen some changes on the page.

Am I doing this wrong or is this page still a work in progress ?

Thanks ahead !

it is still work in progress - but should already give you some ideas.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.