I’ve about 30 sources for my graylog and i want to generate an alert if some sources no longer sends logs for a given period of time.
On my graylog it works if a create one stream and one event definition for each sources but i want to improve this way
Can I do the same with only one stream and one event definitions ?
I try on the “all messages” stream’s : search within the last 5 min, execute search every 5 min
If count(source) <= 0
but it doesn’t work, what i’m doing wrong ?
Lastly, how can I find the name of the sources that no longer send logs if there are no logs because the source is not sending logs. (This is for the email notification)