First of all, this new forum looks great! Good job!
I have long waited to see the renewed Alerts system in Graylog 2.2.0. I have done an upgrade to my test environment and I have been playing with the new alerts.
So my concern is that alert notifications still seem to be bound to streams? I wish they would be bound to alert conditions, so that would allow custom and specific email messages based on the alert condition.
For example (not a real-life scenario): There is a stream called Syslog. I’ll create an alert condition “Alert when the message count is more than 100000 in the last 5 minutes” and bind this to the stream Syslog. Now, I’d like to send an email to "firstname.lastname@example.org" when this alert condition triggers. I’ll create another alert condition “Alert when the message count is less than 50 in the last 5 minutes” and bind this to the stream Syslog too. And now, I’d like to send email to "email@example.com" when this alert condition triggers.
I think I cannot do this within a single stream? I’d need to create two streams with the same syslog messages. And then one alert condition would be bound to the first stream, and another alert condition would be bound to the second stream. This way I could have individual alert notifications, but I’d like to have them without multiple streams.
Please correct me if I’m wrong. Thanks.