Email notifications are behind by one

[jharrison]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
RFID door entry system sends entry logs to Graylog. They show up correctly.
Graylog sends email notifications for that Stream but they are always one behind.
Example:
Person 1 swipes and enters. Entry shows correctly in Graylog. Email notification is for the entry prior to Person 1.
Person 2 swipes and enters. Entry shows correctly in Graylog. Email notification is for Person 1 entry.
I have the Event-Notification set to Backlog of 1 like the documentation says and the message shows the info I need. They just always come in one behind the actual triggered alert.

2. Describe your environment:

• OS Information: Ubuntu 20.04.1

• Package Version: 4.0.1

• Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
I’ve deleted and recreated the event and notification. Other than that I’m not sure where to even start looking.

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hello @jharrison

What does the notification and alerts configurations look like?

[jharrison]

[jharrison]

And here is an example of one of the actual emails. Properly shows the needed info in the backlog section. It’s just that this email notification came in when the next person triggered the system.

[gsmith]

hello @jharrison

Correct me if I’m wrong but the issue is your not receive the notification quick enough?
If this is correct , try decreasing the search within the last to seconds or perhaps add count > 0