Graylog alert condition

[ncmfn (nc)]

Hello,
Is there any way to compare the avg of a field with the sum of that field instead of a threshold in Graylog alerts?
In other word:

if avg(value) > sum (value) then alert

[gsmith]

Hello

Are you referring to something like this for a Event Definition?

[ncmfn (nc)]

Hi @gsmith ,
Instead of these static numbers(0 and 14 in your screenshot), I wanna be able to call another function.
for example:

sum(AccessMask) > avg(AccessMask)

[gsmith]

@ncmfn

sum(AccessMask) > avg(AccessMask)

Not sure about that, you want the sum greater then the avg. Could you give an example of that?

EDIT: Something of this sort? The red box shows what its function is.

If this is not what you want maybe Event Correlation instead of Filter & Aggregation maybe something to look into.

Correlation Engine

[ncmfn (nc)]

Thanks @gsmith,
The point is you are still comparing the sum and avg functions to a static number. in my case there is no specific threshold to set.