Hi all!
After update to Graylog 2.2.* I can’t understand how to edit Field Content Alert. I want to create an alert when field is NOT equal smth. For example:
NOT vpn_addr_country_code:"UA"
At the moment I could make a condition vpn_addr_country_code:“UA” only.
And another related question: how to make a condition where a field is equal to one of the values? For example:
NOT vpn_addr_country_code:(UA ua N/A)
I noticed that edited condition rule looks like: Alert is triggered when messages matching <vpn_addr_whois_organization:"Some ISP">. But there is a difference in search queries field:(vaule1 value2) and field:"(vaule1 value2)"
Thanks in advance!