Alert when there is no logs from particular logsource

[plokesh1 (Lokesh)]

Hi all,

can some one help me,

we are receiving logs from different logsource to the graylog. i want to get an alert if there are no logs from any\one LogSource .

Thanks in advance.

[jan (Jan Doberstein)]

what Version of Graylog are you using?

[plokesh1 (Lokesh)]

Hi Jan,
Thank you for your response.

currently we are using Graylog 3.0

[jan (Jan Doberstein)]

@plokesh1 sorry to say - with that Version it is not possible.

The new alerting - with correlation engine - can make the requested, but not in 3.0

[plokesh1 (Lokesh)]

@jan

with correlation engine - can make the requested, but not in 3.

Thank you,
if you have documentation for correlation engine please share me the URL.

[jan (Jan Doberstein)]

All documentation is given in http://docs.graylog.org/en/3.1/

BUT we are working on this currently. So we have gaps in that. Our Webinar gives you a nice overview: https://www.graylog.org/videos/3-1-webinar