Graylog 3.2 alerts

Graylog Central (peer support)
1

Hi there,

I have setup raw plaintext udp input in order to test some alerts. I was able to send events and search it

echo “Hello Graylog” | nc -w 1 -u 192.168.157.125 5555

After that I have setup following alert filter message:Hello OR source: 192.168.157.125 and I’m able to see the result on Filter Preview

My Group by Field(s) is message and source

The condition is:

IF count() message > 2 OR count() source >2 ANY ANY

Everthing seems ok, but when I send some events there is no alerts

Notification part is working ok, there is no errors in log file
Should I install something additional for alerts ?

2

I found that the problem is only with Aggregation of results reaches a threshold

For example I have tried to setup alert for 2 or more events 5140(S, F): A network share object was accessed.

I use SubjectUserName as filter as you can see from attached screen, and count(), but without any success

aggregation-alert
aggregation-alert1749×580 44.5 KB