Graylog Alerts are really proving their worth here!
How can I limit stream input or condition or alert such that I am notified when a given process or activity being monitored fails (stops producing messages) only during business hours, say, 8a-5p? I won’t even try to tackle “and not school holidays,” unless you have some ideas there…
I have increasingly set these up as heartbeat alert for system processes that must be running (waiting) (and producing log messages) during business hours. After hours, I expect these processes to not produce messages, bc there is no user activity to trigger it.