Get backlog from an alert

Graylog Central (peer support)
1

Hi.
I need to script some actions based on the content of some messages.
I have an alert condition set to trigger when there are more than X messages with the same IP. The backlog is set to 1.
¿Is there a way to get that IP value into my script?
I tried with the execalarmCallback plugin but it has no way of including the backlog message as a parameter.
Then I tried making requests to the API, but I can’t find any way to get the actual content of the messages or any of the extracted fields.

Sadly, I don’t know enough Java to write my own plugin or modify an existent one.

Thanks.

2

What Graylog Version are we talking about?

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.