As many alerts and notifications as messages having the condition defined

Graylog Central (peer support)
1

Hi!

Is there any way to get an alert and the corresponding notification every time a message contains a specific code?

It seems that the alerts come from periodical searches, and I’m afraid of loosing some of these important messages.

I also read that only one notification is sent for each alert until the alert is resolved or until the grace period is granted. And I would like to get as many alerts and notifications as messages having the condition defined.

Thanks,
Yaiza.

2

Yes, create a stream to which all messages with the specific code are added and create an alert which fires when there are any messages in that stream.

As long as the chosen interval (e. g. 5 minutes) is larger than the alert check interval (default: 60 seconds), this schouldn’t be a problem.

3

Thanks.

Yes, create a stream to which all messages with the specific code are added and create an alert which fires when there are any messages in that stream.

One more thing, if I set the condition to have at least one message. How should I clean or remove the messages to avoid firing notifications from the same message?

4

You would wait until the alert condition has been resolved.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.