Graylog alertconditions error

(M D) #1


I used the REST API to create alert conditions. But I entered a wrong field name in one of the conditions. Now When I tried to load the alert conditions in the UI, I get an an error in the log file.

ERROR [AlertConditionFactory] Could not load alert condition ‘testin index alert’ , invalid configuration detected.
ERROR [StreamServiceImpl] Skipping alert condition.
org.graylog2.plugin.configuration.ConfigurationException: Mandatory configuration field dateformat is missing or has the wrong data type
at org.graylog2.plugin.configuration.ConfigurationRequest.check( ~[graylog.jar:?]
at org.graylog2.alerts.AlertConditionFactory.createAlertCondition( ~[graylog.jar:?]
at org.graylog2.alerts.AlertServiceImpl.fromPersisted( ~[graylog.jar:?]
at org.graylog2.streams.StreamServiceImpl.getAlertConditions( ~[graylog.jar:?]
at$all$2( ~[graylog.jar:?]
at$7$1.accept( [?:1.8.0_91]
at$2$1.accept( [?:1.8.0_91]
at java.util.Spliterators$ArraySpliterator.forEachRemaining( [?:1.8.0_91]
at [?:1.8.0_91]
at [?:1.8.0_91]
at$ReduceOp.evaluateSequential( [?:1.8.0_91]
at [?:1.8.0_91]
at [?:1.8.0_91]
at [graylog.jar:?]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_91]
at sun.reflect.NativeMethodAccessorImpl.invoke( ~[?:1.8.0_91]
at sun.reflect.DelegatingMethodAccessorImpl.invoke( ~[?:1.8.0_91]
at java.lang.reflect.Method.invoke( ~[?:1.8.0_91]
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke( [graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$ [graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke( [graylog.jar:?]
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch( [graylog.jar:?]
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch( [graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke( [graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply( [graylog.jar:?]
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply( [graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime$ [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$ [graylog.jar:?]
at org.glassfish.jersey.internal.Errors$ [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process( [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process( [graylog.jar:?]
at org.glassfish.jersey.internal.Errors.process( [graylog.jar:?]
at org.glassfish.jersey.process.internal.RequestScope.runInScope( [graylog.jar:?]
at org.glassfish.jersey.server.ServerRuntime.process( [graylog.jar:?]
at org.glassfish.jersey.server.ApplicationHandler.handle( [graylog.jar:?]
at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service( [graylog.jar:?]
at org.glassfish.grizzly.http.server.HttpHandler$ [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$ [graylog.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_91]
at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_91]
at [?:1.8.0_91]

How can i delete this alert condition from the db as it is not available in the Web UI?

(Jochen) #2

You can delete the alert from the “alerts” collection in MongoDB or use the Graylog REST API (DELETE /streams/{streamId}/alerts/conditions/{conditionId}).

(M D) #3

I have multiple streams and I cannot find what stream they are on.

I checked the “alerts” collection in mongodb ant the collection contains the actual alerts rather than the alert conditions.


{ “_id” : ObjectId(“582c4920bc7c6b1a6c8195bc”), “triggered_at” : ISODate(“2016-11-16T11:55:12.292Z”), “description” : “Stream had 264 messages in the last 45 minutes with trigger condition more than 10 messages. (Current grace time: 0 minutes)”, “condition_parameters” : { “grace” : 0, “threshold_type” : “more”, “threshold” : 10, “time” : 45, “backlog” : 1 }, “stream_id” : “582c34efbc7c6b1a6c817ee0”, “condition_id” : “cd08d207-9d01-4abd-b363-fb6dabe1032c” }
{ “_id” : ObjectId(“582c495cbc7c6b1a6c8195fe”), “triggered_at” : ISODate(“2016-11-16T11:56:12.286Z”), “description” : “Stream had 4 messages in the last 1 minutes with trigger condition more than 2 messages. (Current grace time: 0 minutes)”, “condition_parameters” : { “grace” : 0, “threshold_type” : “more”, “threshold” : 2, “time” : 1, “backlog” : 1 }, “stream_id” : “582c34efbc7c6b1a6c817ee0”, “condition_id” : “e7a273dc-e6f3-4c38-b19a-893eca4552c2” }

(Jochen) #4

You’re right. The alert conditions are stored as embedded documents in the stream definitions in the “streams” collection in MongoDB.

(M D) #5

Thanks for your help.

Got it resolved.

Connected to MongoDB shell and ran command db.streams.find()
Copied the result to notepad++.
Matched the alert condition id in the collection.
Got the relevant stream id of the alert condition.
Used Graylog API to delete the alert conditions.

(Jochen) #6

Could you please post the exact request you’ve been using to create the invalid alert conditions?

This shouldn’t be possible and has to be fixed. Ideally, you could create a bug report at describing the issue.

(M D) #7

The plugins are custom alert condition plugins.
I think I managed to create them because of the free text allowed in the REST API body post request in v2.2. I think this has been fixed in v2.3 and above. I will report the issue if I manage to reproduce this again.


(system) closed #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.