Alert Condition false positive


I just created a alert condition to match multiple URLs. It looks like this:

URL Check (Field Content Alert Condition)
Alerting on stream Proxy-Connections
Configuration: Alert is triggered when messages matching <URI_Host: """ OR "" OR "" OR "" OR "" OR """> are received. Grace period: 0 minutes. Including last message in alert notification. Configured to repeat notifications.

The notification looks like this:


${if backlog} 
${foreach backlog message} 
Zeitstempel (UTC): ${message.fields.timestamp} 
URI_Host: ${message.fields.URI_Host} 
Client: ${message.fields.Client_Address}
${end}${else}<No backlog> ${end}`

Everything works fine, but I get some false positives, like:

kind regards

You can surpass that limit by properly formatting your text snippets, also see Markdown Reference.



Am I the only one?

Am I doing something wrong?

Is there another approach?

The alert condition is incorrect. You cannot use logical OR in alert conditions in that way.

Try creating individual alert conditions instead of using the (incorrect) logical OR in your existing alert condition.

Thanks. So What about list this as an improvement?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.