Event definition not sending alerts

I have created an event definition, hoping to create a different one for each stream since its stream alerts I want. So far I can’t get it to trigger an alert even though the filter preview shows messages in there. The notification works I can receive test emails. I wonder what i’m missing here?

Condition type: Filter & Aggregation
Search Query:
Search within the last: 1 hour
Execute search every: 5 mins
checkmark for: Enabled

Aggregation of results reaches a threshold
Group by Fields:

Condition summary
Condition is valid
Preview: count(message) > 0

The stream is started, and I even set the Search within the last: to 96 hours, the preview shows even more results.

Runs every 5 minutes, searching within the last 4 days. Triggers 1 Notification.

Last execution:
2021-02-04 19:44:33.529
Next execution:
2021-02-04 19:49:17.819
Next timerange:
2021-01-31 19:49:17.820 2021-02-04 19:49:17.819

Event Summary


failed logons

No description given


Filter & Aggregation


Search Query

[failed logons]

Search within
96 hours

Execute search every
5 minutes

Enable scheduling

Group by Field(s)
No Group by configured

Create Events if
count(message) > 0


No Fields configured for Events based on this Definition.



Grace Period is set to 5 minutes
Notifications will include 100 messages

Send to email

Email Notification

Whats your environment setup?
Just an Idea, Have you tried shortening “Search within the last” and “Execute search every” then test a new message going into that stream. If the Test notification works, it might be the configuration. I’m running Graylog 4.0.
here is mine for example:


Hope this helps

Hi, thanks for your reply. From your screenshots, I think the problem was either the count included the field “message” (yours is blank) or less likely the * in the search field. I’m finally getting emails now.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.