# Corellating log messages

**URL:** <https://community.graylog.org/t/corellating-log-messages/4560>\
**Category:** Graylog Central (peer support)\
**Created:** [March 14, 2018, 12:38pm UTC](https://community.graylog.org/t/corellating-log-messages/4560 "2018-03-14T12:38:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![hurzelchen](https://avatars.discourse-cdn.com/v4/letter/h/b9e5f3/32.png) [@hurzelchen](https://community.graylog.org/u/hurzelchen)\
**Post date:** [March 14, 2018, 12:38pm UTC](https://community.graylog.org/t/corellating-log-messages/4560/1 "2018-03-14T12:38:28Z")

</div>

Hi,

I’m still quite new to Graylog which I’m taking over from a colleague.

I’m currently looking for a major feature that I would need. But no search brought up something like that.

Can I correlate two or more log message with each other? I.e. can I check if a log message happened after an other one? Or in other words: Could I have a sort of state for a source that can be change by a certain message but otherwise stays unchanged?

To have a minimal example, let’s say I have the following messages from the same source:

Thing A turned red.  
Thing B made a noise.  
Thing A turned green.  
Thing B made a noise.  
Thing A turned blue.  
Thing B made a noise.

Can I now filter for “Thing B made a noise while thing A was green”?

Thanks,  
Dominik

---

<div class="post-metadata">

**Author:** ![alias](https://avatars.discourse-cdn.com/v4/letter/a/a88e4f/32.png) [@alias](https://community.graylog.org/u/alias)\
**Post date:** [March 14, 2018, 3:17pm UTC](https://community.graylog.org/t/corellating-log-messages/4560/2 "2018-03-14T15:17:18Z")

</div>

In my opinion (not expert product), no.

1. The correlation involves a perfect real time log collection.
2. But you can create severals single alert and create a “last” alert based on previous alerts condition with operator.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 28, 2018, 3:17pm UTC](https://community.graylog.org/t/corellating-log-messages/4560/3 "2018-03-28T15:17:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.