Event definitions and alert if no logs graylog 3.2.5

[michtab (Michel)]

Hi !
I’ve about 30 sources for my graylog and i want to generate an alert if some sources no longer sends logs for a given period of time.

On my graylog it works if a create one stream and one event definition for each sources but i want to improve this way
Can I do the same with only one stream and one event definitions ?

I try on the “all messages” stream’s : search within the last 5 min, execute search every 5 min
If count(source) <= 0
but it doesn’t work, what i’m doing wrong ?

Lastly, how can I find the name of the sources that no longer send logs if there are no logs because the source is not sending logs. (This is for the email notification)

Regards

[shoothub]

Check this:
https://support.graylog.com/help/en-us/13-alerts-notifications/53-content-pack-event-source-not-sending-logs

[michtab (Michel)]

Ok thanks I’ll try this