Event definitions and alert if no logs graylog 3.2.5

Hi !
I’ve about 30 sources for my graylog and i want to generate an alert if some sources no longer sends logs for a given period of time.

On my graylog it works if a create one stream and one event definition for each sources but i want to improve this way
Can I do the same with only one stream and one event definitions ?

I try on the “all messages” stream’s : search within the last 5 min, execute search every 5 min
If count(source) <= 0
but it doesn’t work, what i’m doing wrong ?

Lastly, how can I find the name of the sources that no longer send logs if there are no logs because the source is not sending logs. (This is for the email notification)


Check this:

Ok thanks I’ll try this

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.