Graylog 3.2 alerts

[alex1 (Alex)]

Hi there,

I have setup raw plaintext udp input in order to test some alerts. I was able to send events and search it

echo “Hello Graylog” | nc -w 1 -u 192.168.157.125 5555

After that I have setup following alert filter message:Hello OR source: 192.168.157.125 and I’m able to see the result on Filter Preview

My Group by Field(s) is message and source

The condition is:

IF count() message > 2 OR count() source >2 ANY ANY

Everthing seems ok, but when I send some events there is no alerts

Notification part is working ok, there is no errors in log file
Should I install something additional for alerts ?

[alex1 (Alex)]

I found that the problem is only with Aggregation of results reaches a threshold

For example I have tried to setup alert for 2 or more events 5140(S, F): A network share object was accessed.

5140(S, F) A network share object was accessed. (Windows 10) - Windows security

I use SubjectUserName as filter as you can see from attached screen, and count(), but without any success