# Event definition dont match

**URL:** https://community.graylog.org/t/event-definition-dont-match/36443
**Category:** Graylog Central (peer support)
**Tags:** alert
**Created:** [October 8, 2025, 9:34am UTC](https://community.graylog.org/t/event-definition-dont-match/36443 "2025-10-08T09:34:32Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Hugoo](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@Hugoo](https://community.graylog.org/u/Hugoo)
#### Post date: [October 8, 2025, 9:34am UTC](https://community.graylog.org/t/event-definition-dont-match/36443/1 "2025-10-08T09:34:32Z")

</div>

Hi, I’m new to graylog, I’ve seen a lot of topics on the subject without any real solution for my case.

**1. Describe your incident:**  
I’m trying to create an Event Definition that should trigger ‘\*’. However, despite having matching logs in the stream, the event definition returns no results, no matches, no notification.

**2. Describe your environment:**

- OS Information: RHEL 9.5

- Package Version: Graylog 6.1.6

Configuration :

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7db7b05239d51956bc39785c5772eeb267b9638.png)

See the Replay search finding logs :

 ![Capture d’écran 2025-10-08 111027](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/4/4/444b5eca9b2bfb3c825fb7cea9678d41718701e7.png)

Last mateched : Never

![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/optimized/3X/a/d/adc53375c3799512c6b15bccf011241910b86924_2_690x22.png)

**3. What steps have you already taken to try and solve the problem?**

I’ve verified that the logs are correctly parsed and indexed, and I can manually search for them using the same query.

**4. How can the community help?**  
Maybe I made a mistake? Is this a bug? Is this the graylog version?

Thank for your help

---

<div class="post-metadata">

### Author: ![frantz](https://avatars.discourse-cdn.com/v4/letter/f/dbc845/32.png) [@frantz](https://community.graylog.org/u/frantz)
#### Post date: [October 9, 2025, 12:40pm UTC](https://community.graylog.org/t/event-definition-dont-match/36443/2 "2025-10-09T12:40:17Z")

</div>

Your configuration should work. Did you check if there is an error in server.log ?

---

<div class="post-metadata">

### Author: ![Hugoo](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@Hugoo](https://community.graylog.org/u/Hugoo)
#### Post date: [October 9, 2025, 12:58pm UTC](https://community.graylog.org/t/event-definition-dont-match/36443/3 "2025-10-09T12:58:32Z")

</div>

```auto
I checked this morning, and without changing any configuration, alerts appeared as if by magic.

Maybe it took a while to process, like more than a day, I don't know...

Thanks for your reply!

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [October 23, 2025, 12:59pm UTC](https://community.graylog.org/t/event-definition-dont-match/36443/4 "2025-10-23T12:59:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.