Alert notifications should be bound to alert conditions instead of streams


(Henri Volotinen) #1

Hello,

First of all, this new forum looks great! Good job!

I have long waited to see the renewed Alerts system in Graylog 2.2.0. I have done an upgrade to my test environment and I have been playing with the new alerts.

So my concern is that alert notifications still seem to be bound to streams? I wish they would be bound to alert conditions, so that would allow custom and specific email messages based on the alert condition.

For example (not a real-life scenario): There is a stream called Syslog. I’ll create an alert condition “Alert when the message count is more than 100000 in the last 5 minutes” and bind this to the stream Syslog. Now, I’d like to send an email to "foo@baz.com" when this alert condition triggers. I’ll create another alert condition “Alert when the message count is less than 50 in the last 5 minutes” and bind this to the stream Syslog too. And now, I’d like to send email to "bar@baz.com" when this alert condition triggers.

I think I cannot do this within a single stream? I’d need to create two streams with the same syslog messages. And then one alert condition would be bound to the first stream, and another alert condition would be bound to the second stream. This way I could have individual alert notifications, but I’d like to have them without multiple streams.

Please correct me if I’m wrong. :slight_smile: Thanks.

Br,
Henri


Notification is associated with stream not with condition
(Jan Doberstein) #2

Hej @hezor

you are right, currently your given scenario is not possible. But we already have some feature issues on github that address this:

https://github.com/Graylog2/graylog2-server/issues/3475

Additional the feature to be able to search on multiple streams with some virtual or meta stream would solve your issue

https://github.com/Graylog2/graylog2-server/issues/3473

or at least give you an option how to solve this.

Please feel free to add your use case to the issues to give them more examples.


Notification is associated with stream not with condition