Events based on day: M-F time: lt 6am OR gt 6pm

Graylog Central (peer support)
1

I want to receive an alert email if an event happens BEFORE 6:00am or after 6:00pm every week day (monday through friday).

Is this possible?

2

Simpliest way would be probably to use pipeline rule which create field out_of_hours which can use in your event query.

rule "out_of_hours"
when
to_long(now("Europe/London").hourOfDay) >= 18 AND
to_long(now("Europe/London").hourOfDay) <= 6 AND
to_long(now("Europe/London").dayOfWeek) >= 1 AND
to_long(now("Europe/London").dayOfWeek) <= 5
then
set_field("out_of_hours", true);
//debug("out_of_hours");
end
3

Works like a charm. Thank you.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.