Graylog 4.0 bug with fields and aggregation

Hi all.
We tried to make event definition and wrote this points:

  • in Filter&Aggregation>Aggregation used 3 fields (src_address, dst_address, protocol)
  • making Fields src_address, dst_address, protocol
    and it does no alerts at all…
    when we leave only 1 field - it works
    more then 1 -no alert and no fields
    when we leave 1 field and 3 fields - we get 1 alert and 1 field in notifications
    who can help or explain how it works?

@aldot

Hello and Welcome

I’m not sure what version of Graylog your using, also its hard to tell what could be the problem. Could you explain what your goal is with Filter&Aggregation in greater detail? Maybe some examples of the outcome you wanted and/or messages your trying to filter out. That would be very helpfull.

Have you seen this link?

https://docs.graylog.org/en/4.0/pages/alerting/alerting-by-example.html

Hope that helps.