I have Graylog setup to parse logs it receives from CloudTrail. This seems to work fine. I’d like to configure Graylog alerts for some CloudTrail events. However, the Graylog alert I created as a test does not seem to trigger.
I’ve setup a Field Content Alert Condition with Field=event_name, Value=CreateUser, Grace Period=1, and Message Backlog=1. Even when I create a user in my AWS account I don’t see an alert from Graylog. I can see the message coming into the stream just fine. Has anyone configured Graylog to alert from CloudTrail before?
I don’t know if this is relevant but it can sometimes take ~15 minutes from the time an event is initiated to the time a log entry appears in CloudTrail. I don’t know if this has a bearing on the alert generation from Graylog. It doesn’t seem like it should.
I’m using Graylog 2.2.3+7adc951. Any advice is greatly appreciated. Thanks.
Edit: From this post, https://github.com/Graylog2/graylog2-server/issues/3881, it appears the delay in CloudTrail could be a problem. For example, if I create a user at 10:50am in AWS, the CloudTrail log for that event may not show up until 11:05am but that event will contain the correct time the user was created, 10:50am. If events for alerts are processed every minute, could this be missed?