Using Graylog = 2.4.5.
I am using
Condition Type : Field content Alert Condition
Condition Definition : Field = “state” , Value = “failed” , Grace Period = “0” , Message Backlog = “1”
Problem:
Even when this condition satisfies, there is no alerts shown in the alerts section, therefore, neither I am getting any alerts on email. Please help/suggest, what can I do to solve/debug this problem? Example image is as shown below:
Message is like shown in the image below:
did you checked the correct stream with the alerts?
@jan I am sure that stream connected to alert condition is correct.
Actually, the flow of message is like:
Beats add a field called “rundeck” with value “executionslog” to the message.
Based on this field value, the message goes into the stream (let’s say “Runceck : Executions Log”).
This stream is connected to the pipeline, which extracts and set a field “state” with value either “failed” or “succeed” based on message content.
In the Alerts section, I have created a condition (Field content Alert Condition) on this stream (Rundeck : Executions Log). As per the definition of the condition, an alert should be generated/registered, but it is not happening.
I have tried testing it with different fields and their values satisfying alert condition but getting no alert at all.
did you change this setting?
Did you have any kind of alerts working and only this fails or are all not working?
@jan
alert_check_interval was set as 1 second earlier. Now, I set it to 30 seconds and the Alerts for Field Content are registering now.
Earlier, even with alert_check_interval = 1, Message Count Alert Condition was working fine.
Can you please brief, Why Field Content Alert Condition was not working with alert_check_interval = 1?
Alerts are automated searches and with the check interval set to 1 second the search is done every second - if the search does not return before the next run the status will be overwritten and it never returns with a result.
It is save with running every 60 seconds - the default - shorter times might behave different.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
