Create streams on number of days

is it possible to create stream that can show the messages as per number of last days? last 1 day , last 14 days and so on.

Why you want to create this? I think that it’s easier to change the search relative time interval to 1 day, 14 days. You can then save each time interval with button Save search criteria. After that you can simple select conveniently saved intervals on the righ side selectbox.

If you need special time interval you can use Keyword interval and input for example last week, last 90 day and so on, check examples on documentation.

https://docs.graylog.org/en/3.1/pages/queries.html#time-frame-selector
https://docs.graylog.org/en/3.1/pages/queries.html#saved-searches

Actually, I have created the stream with my search criteria.
I want send the alerts out of this stream whenever my search criteria will match.
currently. the problem is we do not have the new messages coming to Graylog. so when I search the messages for last 14 days i can see the message. I want to send these last 14-days messages via E-mail.

I would use alert functionality to send email with messages:
https://docs.graylog.org/en/3.1/pages/streams/alerts.html

If you need only extract messages you can still use export to CSV:
https://docs.graylog.org/en/3.1/pages/queries.html#export-results-as-csv

This am using this E-mail feature only.
I am not able to find the condition that will search in my search criteria on the basis of time range.
I am using Graylog 2.4.

you should update to the latest Graylog release to have more/better options that should solve your current issue.

I have another instance as well with Graylog 3.0 version but their also I am not able see this feature.

please check graylog 3.1 version. This version has a feature to search in (Search within the last:) interval.
https://docs.graylog.org/en/3.1/pages/streams/alerts.html#filter

Yes I noticed.

Thank You!!!

export CSV option is not working in my Graylog instance.
whenever i click on download it says not reachable.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.