Alerts on content by count


I’m trying to figure out if this is possible with the current alert conditions. I understand we can alert by count and we can alert by content but what if I want an alert after a field value has Y come in X number of times? (I’m not sure I understand the aggregate condition, an explanation would be appreciated)

In our environment, every updown cisco event, after going through a pipeline, gets a field added with the source and interface concatenated. That way we use quick values on a dashboard to check what interfaces may be acting up.

so lets say in the last 5 minutes the field “interface” has had the following values:

How can I get alerted if field “interface” gets a count of 5+ of the same value? so for the example above alerting me that “interface” has gone over the threshold with value “” being logged more than 5 times within the last 5 minutes


In my system I use scripts to do this. I’ll have a stream that gets messages that say contain your interface field. Then I have an alert for an HTTP callback for any messages that come in the stream that sends to a server with a perl script that parses the POST information and does the alert logic from there.

@desertjedi85 Thtats a good idea and if there is no actual way to do this within graylog, I will definitely consider that.

However, if there is a way to accomplish this without the introduction of another server that’d be ideal

Hej @sgarciam

please raise a feature issue over at github for that.

thank you

Was about to but it seems @joruro beat me to it :slight_smile:

After testing, the Aggregates plugin available on the marketplace made by cvtienhoven does work for this purpose thou it would be great to see it implemented within the alerts framework.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.