# Alert conditions **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 16, 2017, 10:24am UTC](https://community.graylog.org/t/alert-conditions/80 "2017-02-16T10:24:24Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Evgeniy](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Evgeniy](https://community.graylog.org/u/Evgeniy)\ **Post date:** [February 16, 2017, 10:24am UTC](https://community.graylog.org/t/alert-conditions/80/1 "2017-02-16T10:24:24Z")
Hello! How to configure alert condition, that would graylog had sent all the posts falling within the stream. Now I use сonfiguration: Alert is triggered when there are more than 0 messages in the last minute. Grace period: 0 minutes. Including last 5 messages in alert notification. But then when the trigger occurs, the new messages in stream don’t create a new trigger if old is not resolved. Because of this, security events are skipped in the mail. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [February 16, 2017, 1:42pm UTC](https://community.graylog.org/t/alert-conditions/80/2 "2017-02-16T13:42:24Z")
Hello Evgeniy, which version of Graylog are you using? With version 2.2 (and the 2.2-beta versions), Graylog switched the alerting system to stateful alerts/notifications. This means, a triggered alert will only send one notification (email) and wait until it has been cleared to generate a new notification. See this “[With the new stateful notifications, you will not be notified again until the alert condition is no longer satisfied.](https://www.graylog.org/blog/88-announcing-graylog-v2-2-0)” on the Graylog blog. Since you are looking for the message count being larger than 0 in the stream, this alert condition could stay satisfied for a long time. As far as I know there is no plugin availiable, that acts as a output and sends the messages in emails. This could be an idea for a new plugin, I might look into it when I’ve got time 🙂 You could try the [Aggregates Plugin](https://marketplace.graylog.org/addons/0d01a899-138a-4f77-a9e7-04be4cc5e190) since this uses a custom timing cycle… ---
**Author:** ![Evgeniy](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Evgeniy](https://community.graylog.org/u/Evgeniy)\ **Post date:** [February 17, 2017, 6:43am UTC](https://community.graylog.org/t/alert-conditions/80/3 "2017-02-17T06:43:56Z")
Hello DerPhlipsi, thanks for your reply. I using graylog version 2.2. I tried to use Aggregates Plugin, but it’s not exactly what I need and i don’t can customize notifications. It would be cool if you can realize the function of sending all messages from the Stream to the mail. I think this feature is useful to many. Thank you very much. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [February 17, 2017, 6:53am UTC](https://community.graylog.org/t/alert-conditions/80/4 "2017-02-17T06:53:03Z")
Hey @Evgeniy, FYI I just saw this: [https://github.com/Graylog2/graylog2-server/issues/3511](https://github.com/Graylog2/graylog2-server/issues/3511). This adresses your issue, maybe it is included in one of the next bug-fixes. Greets - Phil ---
**Author:** ![KO1984](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@KO1984](https://community.graylog.org/u/KO1984)\ **Post date:** [March 1, 2017, 1:35am UTC](https://community.graylog.org/t/alert-conditions/80/5 "2017-03-01T01:35:30Z")
Am I wrong, or shouldn’t this cause an email on every message? > Alert is triggered when there are more than 0 messages in the last 0 minutes. Grace period: 0 minutes. Including last message in alert notification. Or does this just cause no emails to be sent? ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [March 1, 2017, 5:07pm UTC](https://community.graylog.org/t/alert-conditions/80/6 "2017-03-01T17:07:54Z")
Well, this is something Graylog is accepting as valid configuration. But I don’t know what its behaviour is… Are you able to test it? 🙂 ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [March 1, 2017, 5:48pm UTC](https://community.graylog.org/t/alert-conditions/80/7 "2017-03-01T17:48:34Z")
I just figured it out. Graylog uses 0 as a marker for all messages, this is also true in alerts. So this will make Graylog trigger once and will keep the alert active forever (Look at the Triggered at timestamp), or until your stream actually has no messages in it (e.g. when all indexes are closed) ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/ab0299012898e98217c5021d331722784cce42c4.png) ---
**Author:** ![KO1984](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@KO1984](https://community.graylog.org/u/KO1984)\ **Post date:** [March 1, 2017, 7:01pm UTC](https://community.graylog.org/t/alert-conditions/80/8 "2017-03-01T19:01:32Z")
Good to know. Do you know if there’s a fix in the works for this? I was reading a lot of people are wanting the previous version back. What I’m ultimately needing is a means of specifying that I want a new alert for every different message fired off within a specified timeframe. What would be nice (for testing at least) is to be able to set it to send an email for every new message received. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 2, 2017, 8:11am UTC](https://community.graylog.org/t/alert-conditions/80/9 "2017-03-02T08:11:58Z")
> [@KO1984](#): > > Do you know if there’s a fix in the works for this? > > > This is a port of #3536 to the \`2.2\` branch. > > \* Add option to repeat notificat…ions > > Refs #3511 > > \* Resend notifications when user sets the flag > > When user sets the \`repeat\_notifications\` flag in the alert condition, > resend the notifications regardless of the alert state. The alert will > continue to have a state anyway, and all sent notifications will be > visible in the web interface on the alerts detail page. > > Refs #3511 > > \* Add repetition setting to alert summaries > > \* Add repetition setting to alert timeline > > \* Add date to notification histories > > \- Sort histories by creation datetime > \- Add the time were the notification was sent, to help seeing the order > and also that the attempts sending the notification are different > > \* Do not include ms in history datetime > > \* Add license header > > \* Rename variable > > \* Fix import > > \* Use moment to sort notifications by date > > (cherry picked from commit 003bea90a4e67c15fca557c96fcd2665c23f90cc) ---
**Author:** ![KO1984](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@KO1984](https://community.graylog.org/u/KO1984)\ **Post date:** [March 2, 2017, 6:14pm UTC](https://community.graylog.org/t/alert-conditions/80/10 "2017-03-02T18:14:14Z")
Does this mean a fix is in the works, available, what? Forgive me for my ignorance, but what exactly does this mean? I’m still new to using github, so I’m just wanted to make sure I understand this properly. If the fix is there, am I able to pull it down and apply it? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 2, 2017, 6:38pm UTC](https://community.graylog.org/t/alert-conditions/80/11 "2017-03-02T18:38:42Z")
Stateful alert notifications have been made optional in Graylog 2.2.2, which was released today. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [March 2, 2017, 7:50pm UTC](https://community.graylog.org/t/alert-conditions/80/12 "2017-03-02T19:50:33Z")
Hey @KO1984, > [@jochen](#): > > > [@ko1984](#): > > > > Do you know if there’s a fix in the works for this? > > [Give an option to repeat alert notifications (#3536) by dennisoelkers · Pull Request #3544 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/pull/3544) This means, that a fix is already implemented in (merged into) the [most recent code of the 2.2 branch](https://github.com/Graylog2/graylog2-server/commits/2.2) available on GitHub. So if you want to use the fix, you could download the [release](https://github.com/Graylog2/graylog2-server/releases/tag/2.2.2) @jochen mentioned and [compile](https://groups.google.com/forum/#!topic/graylog2/0E3vjMVQ-dc) it yourself, or you just wait for update 2.2.2 to become available as “official download” on the [Graylog Download Page](https://www.graylog.org/download). Greetings - Phil _ **PS:** _ I wrote this before @jochen answered but had to go afk, so I’ll post it anyway for your information. 😃 ---
**Author:** ![KO1984](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@KO1984](https://community.graylog.org/u/KO1984)\ **Post date:** [March 2, 2017, 10:19pm UTC](https://community.graylog.org/t/alert-conditions/80/13 "2017-03-02T22:19:29Z")
Thank you! You guys are awesome. I really appreciate the help. ---
**Author:** ![derPhlipsi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/derphlipsi/32/38_2.png) [@derPhlipsi](https://community.graylog.org/u/derPhlipsi)\ **Post date:** [March 2, 2017, 10:31pm UTC](https://community.graylog.org/t/alert-conditions/80/14 "2017-03-02T22:31:01Z")
Your welcome 🙂 Greetings - Phil ---
**Author:** ![KO1984](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@KO1984](https://community.graylog.org/u/KO1984)\ **Post date:** [March 3, 2017, 4:38pm UTC](https://community.graylog.org/t/alert-conditions/80/15 "2017-03-03T16:38:41Z")
As a last thing, as it stands, is there any way to make it so that alert emails are sent on every message received in a stream? I’ve tried a few configurations, but I’m still having alerts stack messages. This is a problem if I get multiple messages from the same source, but of a different meaning. ---
**Author:** ![avongluck-r1soft](https://avatars.discourse-cdn.com/v4/letter/a/53a042/32.png) [@avongluck-r1soft](https://community.graylog.org/u/avongluck-r1soft)\ **Post date:** [April 17, 2017, 7:04pm UTC](https://community.graylog.org/t/alert-conditions/80/16 "2017-04-17T19:04:28Z")
OMG… this issue has been _so_ annoying. So given the logic there really isn’t a way to raise an alert if a message count is 1 or greater without hacking in the usage of “repeat notifications”? EDIT: I tested this and removing all 0’s from conditions didn’t really help our issues with alerts never closing… what is going on with 2.2.x? ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [April 18, 2017, 7:49am UTC](https://community.graylog.org/t/alert-conditions/80/17 "2017-04-18T07:49:55Z")
> [@avongluck-r1soft](#): > > OMG… this issue has been so annoying. So given the logic there really isn’t a way to raise an alert if a message count is 1 or greater without hacking in the usage of “repeat notifications”? What’s the alert condition you want to formulate? ---
**Author:** ![avongluck-r1soft](https://avatars.discourse-cdn.com/v4/letter/a/53a042/32.png) [@avongluck-r1soft](https://community.graylog.org/u/avongluck-r1soft)\ **Post date:** [April 18, 2017, 3:19pm UTC](https://community.graylog.org/t/alert-conditions/80/18 "2017-04-18T15:19:53Z")
The most simple condition. If stream has any new events, raise an alert + grace period. Right now: Stream picks up issues -\> Condition message count \> 0 -\> One or more notifications. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [April 18, 2017, 3:53pm UTC](https://community.graylog.org/t/alert-conditions/80/19 "2017-04-18T15:53:10Z")
Try using the following Message Count Alert Condition: > Alert is triggered when there are more than 0 messages in the last 5 minutes. Grace period: 5 minutes. Not including any messages in alert notification. Configured to repeat notifications. The JSON payload for this would be: ```json { "title" : "Alert Condition title", "creator_user_id" : "admin", "type" : "message_count", "parameters" : { "backlog" : 0, "threshold" : 0, "threshold_type" : "MORE", "repeat_notifications" : true, "time" : 5, "grace" : 5 } } ``` ---
**Author:** ![avongluck-r1soft](https://avatars.discourse-cdn.com/v4/letter/a/53a042/32.png) [@avongluck-r1soft](https://community.graylog.org/u/avongluck-r1soft)\ **Post date:** [April 18, 2017, 4:00pm UTC](https://community.graylog.org/t/alert-conditions/80/20 "2017-04-18T16:00:47Z")
The problem with that is it doesn’t solve the issue I see. The alerts remain open forever even though only one event was received. Even with the grace period, Graylog alerts every 5 minutes “until the server is restarted” Something is causing the alert conditions to always be matched. Screenshots and details in [https://github.com/Graylog2/graylog2-server/issues/3663](https://github.com/Graylog2/graylog2-server/issues/3663) Just follow the logic in this one screenshot and it doesn’t make sense 🙂 ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/1X/5286deed5d6d0cfdea03ac9b0f5233455fbc1fa6.png)