I have was navigating around graylog alert part. And I saw a Event correlation rule, it only accept some event inside illuminate.
Can I create my own event to to put inside the event to do a correlation?
Yes, any active event can be chosen to use in a correlation event.
Yea I have found out how to do it.
Needed to add a Filter & Aggregation before we able able to add into the event correlation.
Thanks for your reply.