Graylog 3.2 alert when host drops off

[mschroeder (Michael)]

I’ve been looking at how to monitor if a host drops off from logging to graylog. Is there any way within graylog to check for this? For example, say I have 100 hosts that are all supposed to be logging, then all of a sudden Graylog only sees 99 hosts. It would be nice if this was a feature in the alerts section.

[ttsandrew]

There’s a content pack for this but I could never make it work correctly. Maybe you’ll have better luck.

Event definition help

I’m trying to set up event definitions so that an alert is generated if no messages are received from a source within a timeframe. I thought I could do this using an aggregation and setting the trigger to less than a number, but it isn’t working. Also, ideally I would like this to use a static list of sources so that the query can execute dynamically against that list and generate an alert for each that qualifies. Has anyone else done this? Any idea if it’s possible? I’m not having a lot of luck…