Graylog > Alerts > Conditions not registering any alerts at all


(Anmol Sharma) #1

Using Graylog = 2.4.5.

I am using
Condition Type : Field content Alert Condition
Condition Definition : Field = “state” , Value = “failed” , Grace Period = “0” , Message Backlog = “1”

Problem:
Even when this condition satisfies, there is no alerts shown in the alerts section, therefore, neither I am getting any alerts on email. Please help/suggest, what can I do to solve/debug this problem? Example image is as shown below:

Message is like shown in the image below:


(Anmol Sharma) #2

@jan Please respond. Needed help!!


(Jan Doberstein) #3

did you checked the correct stream with the alerts?


(Anmol Sharma) #4

@jan I am sure that stream connected to alert condition is correct.

Actually, the flow of message is like:
Beats add a field called “rundeck” with value “executionslog” to the message.
Based on this field value, the message goes into the stream (let’s say “Runceck : Executions Log”).
This stream is connected to the pipeline, which extracts and set a field “state” with value either “failed” or “succeed” based on message content.

In the Alerts section, I have created a condition (Field content Alert Condition) on this stream (Rundeck : Executions Log). As per the definition of the condition, an alert should be generated/registered, but it is not happening.

I have tried testing it with different fields and their values satisfying alert condition but getting no alert at all.


(Jan Doberstein) #5

did you change this setting?

Did you have any kind of alerts working and only this fails or are all not working?


(Anmol Sharma) #6

@jan
alert_check_interval was set as 1 second earlier. Now, I set it to 30 seconds and the Alerts for Field Content are registering now.

Earlier, even with alert_check_interval = 1, Message Count Alert Condition was working fine.

Can you please brief, Why Field Content Alert Condition was not working with alert_check_interval = 1?


(Jan Doberstein) #7

Alerts are automated searches and with the check interval set to 1 second the search is done every second - if the search does not return before the next run the status will be overwritten and it never returns with a result.

It is save with running every 60 seconds - the default - shorter times might behave different.


(system) #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.