Graylog Query Using Time

[gsmith]

Hello,

@cbryner

This may not be something that can be done we are trying to have a query that looks at the login time and records on a dashboard any time there is a login time past closing hours.

You may want to look at these posts.

User logged in Outside Business Hours

I have to give respect to @jan for showing me this. This became the most importent Pipeline we use in multiply environments. rule "Between 6 PM and 6 AM" when ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 0 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 6 ) OR ( to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) >= 18 AND to_long(to_date($message.timestamp, "American/Chicago").hourOfDay) <= 0 ) then set_field("trigger_workh…

And this gives added details.

Time based alerts

Hello, I think your referring to this? You may need to adjust the configurations to your needs.

hope that helps