Event definitions not create alerts

[mmaslouj (Mohamed Maslouh)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
Hello,

Im new graylog, so im trying the setup my first Event definition but it doesn’t generate any alerts.

2. Describe your environment:

• OS Information:
  Ubuntu 20.04

• Package Version:
  4.2.9-1

• Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

4. How can the community help?
If someone have can fix it please. Thanks.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[gsmith]

Hello && welcome @mmaslouj

Judging from that screenshot, I’m unsure what the issue is. Does the word Failed get searched at all?

Testing, try to increase the search time from 1 minute to like an hour see if it will come though in the right pane.
Also, maybe use something like this with quotes.

"Failed"
or
"failed"

[mmaslouj (Mohamed Maslouh)]

Hello @gsmith,

You right, i was searching from events for last 1 min.

Now it start show me result in filter preview but still no notification triggred.

[mmaslouj (Mohamed Maslouh)]

[mmaslouj (Mohamed Maslouh)]

[mmaslouj (Mohamed Maslouh)]

Now i start getting events but it show only the previous actions, the “Next timerange” not change by time.

[gsmith]

Hello,

@mmaslouj

i was searching from events for last 1 min.

I was just stating about increasing the search time to insure messages could be scanned, but 1 minutes is good for search time. if you don’t see it in one minute you may need to wait.

Next would be you notification settings.

Example:
Summary should look something like this.