Graylog 6.0 Triggering alerts when conditions not met

patrickmann · September 27, 2024, 10:11am

I think you may be running into an OS 2.16 issue.
Check out this for a discussion and workaround:

github.com/Graylog2/graylog2-server

Opensearch 2.16.0 breaks alerts

opened 10:23AM - 08 Aug 24 UTC

closed 02:41PM - 19 Aug 24 UTC

fjl82

bug

Last night, Opensearch got upgraded from 2.15.0 to 2.16.0. Nothing else was chan…ged. After this, alerts started coming in with a high message count but no messages listed in the email (normally max 3 are included). Using the search replay shows no messages either. It seems to apply to *all* configured alerts. Normal message searches also work fine. Trying to downgrade Opensearch fails. On startup it stops with an error: java.lang.IllegalStateException: cannot downgrade a node from version [2.16.0] to version [2.15.0] If you need me to check anything, or need more info, let me know. ## Expected Behavior Alerts should behave as before on 2.15.0. ## Current Behavior Alerts keep triggering with an ever rising message count ## Possible Solution Support opensearch 2.16.0 ## Steps to Reproduce (for bugs) 1. Upgrade an existing installation with Opensearch 2.15.0 to 2.16.0 ## Context Alerts are currently unusable. This is the feature in Graylog we use most (alerting us to application issues). ## Your Environment * Graylog Version: 6.0.5 * Java Version: 17.0.12+7-1ubuntu2~22.04 * OpenSearch Version: 2.16.0 * MongoDB Version: 6.0.16 * Operating System: Ubuntu 22.04 * Browser version: n/a

Topic		Replies	Views
Help with setting up Aggregation Events in Graylog Open New to Graylog Community? READ-ME FIRST Guides	0	6	May 22, 2025
Aggregation Count Alert Condition Plug-Ins plug-in	1	1780	August 25, 2022
Graylog 3.2 alerts Graylog Central (peer support)	2	411	March 25, 2020
Alert if no logs Graylog Central (peer support)	3	3249	March 11, 2020
Graylog Alert Fields are not getting filled when using a Threshold Graylog Central (peer support)	11	290	August 1, 2024

Graylog 6.0 Triggering alerts when conditions not met

Related topics