Alerting on trends - Graylog 3.2

Graylog Central (peer support)
,
1

Hi All,

Is it possible to set alerts on trends? This post gives a nice example on trend analysis TREND ANALYSIS WITH GRAYLOG but with no hints on how to setup alerts on, say, sudden spike in incoming messages.
I initially thought that maybe the enterprise correlation engine would be required for that, but having watched https://www.graylog.org/videos/correlation-engin I’m not sure, seems the correlation thresholds are also just numbers, not relative values.

So… any recommended / feasible way on setting alerts when trends change?

Regards,
Mike

ps. I’m on Graylog 3.2.4+a407287 (AdoptOpenJDK 11.0.6 on Linux 5.3.0-40-generic) / Ubuntu 18.04.4 LTS; filebeat is the main source of data into Graylog.

2

I can think of this to be possible with the correlation engine. I have done only the notification yet when a log source went silence: https://support.graylog.com/help/en-us/13-alerts-notifications/53-content-pack-event-source-not-sending-logs

but it should be possible to make the same assumption to “if this is more than” …

1 Like
3

Thank you Jan, I’ll have a look into this.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.