Graylog aggregation that shows message time delta from last message

[KarlErik (Karl Erik Mander)]

Hello

I am from a small company that does dog trackers that use GSM as communication.
The dog trackers send packet every defined time amount and we need a way to check if device firmware is doing whats it is told to do.

I want to create an aggregation that shows time in seconds from the last packet in the graph.
Every message has device IMEI so device messages would be categorized by it.

Calculate time delta between events

Thanks for the reply jochen. Can you give me an idea of what path I’d need to go down to get this to work? Is this a matter of doing something with a pipeline or would I need to get deeper than that? I know that I can do this with elapsed in ELK and transaction in Splunk but I’m really liking Graylog and would much prefer to stick with it. TIA!

I found one topic on this kind of problem whats from 2017 that suggested using REST API to get data and then calculate the data but I would like to show the time delta in a graph in the Graylog dashboard.

Graylog version: Graylog 4.1.1+27dec96

Best regards
Karl Erik Mander

[KarlErik (Karl Erik Mander)]

Update

I grouped timestamp with device IMEI and used cardinality to get a graphical view of device log count.
From there it is possible to notice bumps or holes where the device has not sent anything or sent too much.

This is the current solution that I have come up with.

[gsmith]

Hello && Welcome

I might be able to help.

@KarlErik

where the device has not sent anything

I found a couple post if your not aware of, that might help.

Notification alert if device is not sending log

Hi Team, we are facing some issue in the notification, In our setup, we are getting 300 network device logs but the issue is that if any device stops the sending log in Graylog server due to some reason so how we can know in Graylog. we are also monitoring our service and port, but please help on same how we can resolve the same issue.

Alerting/Notification when certain sources are not reporting

@gsmith Unfortunately there’s not a built in mechanism for this in the enterprise version either, we use it and ended up crafting our own solution. We couldn’t get the content pack to work the way we wanted either.

As for…

@KarlErik

or sent too much.

Graylog 4.x has a dashboard called Source. You should be able to see your message count from each source (device). You could use that for your alerts or graphs on the amount of data received. This would all depend on how you configured/installed your environment.

EDIT: Below I did a quick widget mockup. I added Group By source. Then added Metrics Count w/ field gl2_accounted_message_size. Basically the Default widget on Graylog’s Dashboard called Sources. As you can see it shows my sources (devices) and how many messages are within one hour. This helps keep an eye on the average amount of messages per hour. You can always modify it further.

[KarlErik (Karl Erik Mander)]

Thank you for your response.

The message size is not important to us because the log size can vary but the count of the messages is needed.
I have created the following setup for finding disturbances what should be a linear graph of device sending intervals.

This way the blue graph shows that the device with censored IMEI is currently sending with a fixed time interval until a point that is circled with red.
The other devices have only one point or more depending on their defined information packet interval.

I hope this kind of “hack” helps somebody with a similar issue.

Thank you!

[gsmith]

Thanks for sharing your configuration, I also tested this in the lab and works good.