Corellating log messages

Graylog Central (peer support)
1

Hi,

I’m still quite new to Graylog which I’m taking over from a colleague.

I’m currently looking for a major feature that I would need. But no search brought up something like that.

Can I correlate two or more log message with each other? I.e. can I check if a log message happened after an other one? Or in other words: Could I have a sort of state for a source that can be change by a certain message but otherwise stays unchanged?

To have a minimal example, let’s say I have the following messages from the same source:

Thing A turned red.
Thing B made a noise.
Thing A turned green.
Thing B made a noise.
Thing A turned blue.
Thing B made a noise.

Can I now filter for “Thing B made a noise while thing A was green”?

Thanks,
Dominik

2

In my opinion (not expert product), no.

  1. The correlation involves a perfect real time log collection.
  2. But you can create severals single alert and create a “last” alert based on previous alerts condition with operator.
3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.