Graylog aggregation that shows message time delta from last message

[gsmith]

Hello && Welcome

I might be able to help.

@KarlErik

where the device has not sent anything

I found a couple post if your not aware of, that might help.

Notification alert if device is not sending log

Hi Team, we are facing some issue in the notification, In our setup, we are getting 300 network device logs but the issue is that if any device stops the sending log in Graylog server due to some reason so how we can know in Graylog. we are also monitoring our service and port, but please help on same how we can resolve the same issue.

Alerting/Notification when certain sources are not reporting

@gsmith Unfortunately there’s not a built in mechanism for this in the enterprise version either, we use it and ended up crafting our own solution. We couldn’t get the content pack to work the way we wanted either.

As for…

@KarlErik

or sent too much.

Graylog 4.x has a dashboard called Source. You should be able to see your message count from each source (device). You could use that for your alerts or graphs on the amount of data received. This would all depend on how you configured/installed your environment.

EDIT: Below I did a quick widget mockup. I added Group By source. Then added Metrics Count w/ field gl2_accounted_message_size. Basically the Default widget on Graylog’s Dashboard called Sources. As you can see it shows my sources (devices) and how many messages are within one hour. This helps keep an eye on the average amount of messages per hour. You can always modify it further.