Graylog alert condition

Is there any way to compare the avg of a field with the sum of that field instead of a threshold in Graylog alerts?
In other word:

if avg(value) > sum (value) then alert


Are you referring to something like this for a Event Definition?

Hi @gsmith ,
Instead of these static numbers(0 and 14 in your screenshot), I wanna be able to call another function.
for example:

sum(AccessMask) > avg(AccessMask)

Not sure about that, you want the sum greater then the avg. Could you give an example of that?

EDIT: Something of this sort? The red box shows what its function is.

If this is not what you want maybe Event Correlation instead of Filter & Aggregation maybe something to look into.

Thanks @gsmith,
The point is you are still comparing the sum and avg functions to a static number. in my case there is no specific threshold to set.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.