# Graylog Alerting pipelines
**URL:** https://community.graylog.org/t/graylog-alerting-pipelines/5546
**Category:** Graylog Central (peer support)
**Created:** [June 11, 2018, 2:51pm UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546 "2018-06-11T14:51:05Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@smigal66](https://community.graylog.org/u/smigal66)
#### Post date: [June 11, 2018, 2:51pm UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546/1 "2018-06-11T14:51:06Z")
Hello community !
I want to know if it is possible to create an alert and apply it to a time slot
Exemple: have an unsuccessful ssh connection between 00:00 and 06:10
Would it be possible to have a syntax to use processing pipelines for tchecking on the time
For exemple : tchecking between 00:00 and 06:00 every day
Thanks for your feedback
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [June 11, 2018, 3:35pm UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546/2 "2018-06-11T15:35:29Z")
As @jan already described in [Graylog Alerting Question](https://community.graylog.org/t/graylog-alerting-question/5536/2), you could write a pipeline rule which checks if the “timestamp” field contains a timestamp between 0 and 6 o’clock, and then set a custom flag field.
Once the field’s there, you can create an alert condition which checks the field content and triggers an alert if your conditions have been met.
Example:
```nohighlight
rule "Between 0 and 6 o'clock"
when
to_date($message.timestamp).hourOfDay >= 0 && to_date($message.timestamp).hourOfDay <= 6
then
set_field("trigger_alert", true);
end
```
---
### Author:  [@smigal66](https://community.graylog.org/u/smigal66)
#### Post date: [June 13, 2018, 8:47am UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546/3 "2018-06-13T08:47:11Z")
Hello community !
Thank you for your reply
I want to do other scenarios, such as the detection of several unsuccessful ssh attempts, followed by a success for the same user, is it possible to do that on graylog ?
Thanks for your feedback
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [June 13, 2018, 8:58am UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546/4 "2018-06-13T08:58:47Z")
> [@smigal66](#):
>
> I want to do other scenarios, such as the detection of several unsuccessful ssh attempts, followed by a success for the same user, is it possible to do that on graylog ?
You could probably build something like this with the 3rd party [SLookup plugin](https://marketplace.graylog.org/addons/3780dc6a-13f5-4f62-8546-595be7d3e37a).
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [June 27, 2018, 8:58am UTC](https://community.graylog.org/t/graylog-alerting-pipelines/5546/5 "2018-06-27T08:58:51Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.