# How Graylog set alert field value to true or false

**URL:** <https://community.graylog.org/t/how-graylog-set-alert-field-value-to-true-or-false/11960>\
**Category:** Graylog Central (peer support)\
**Created:** [September 13, 2019, 10:02am UTC](https://community.graylog.org/t/how-graylog-set-alert-field-value-to-true-or-false/11960 "2019-09-13T10:02:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/g/b487fb/32.png) [@Ganeshbabu](https://community.graylog.org/u/Ganeshbabu)\
**Post date:** [September 13, 2019, 10:02am UTC](https://community.graylog.org/t/how-graylog-set-alert-field-value-to-true-or-false/11960/1 "2019-09-13T10:02:14Z")

</div>

Hi All,

We are using Graylog 3.1.1 with Elasticsearch 6.8.1 & Mongo 3.6.14. I am trying to setup **[alerts](http://docs.graylog.org/en/3.1/pages/streams/alerts.html#alerts)** based on the event condition.

I am receiving IIS logs to graylog and I am setting **iis\_Access\_Responsecode:\>=500** in event filter condition with aggregation group by field as **iis\_Access\_SiteName** and if my events count is \> than 5 alerts will be triggered.

Yes I am able to see alerts triggered based on the event definition and messages are recorded to the “All Events” stream. But in the all events stream I am getting two types of messages and the field **“alert”** has two values,

1. alert=false
2. alert=true

Below is the sample message with alert= false

```
    "_source" : {
      "id" : "01DMFWQERB48FSDMVZTNSYD",
      "event_definition_type" : "aggregation-v1",
      "event_definition_id" : "5d76470a026d94693",
      "origin_context" : null,
      "timestamp" : "2019-09-11 10:08:14.276",
      "timestamp_processing" : "2019-09-11 10:08:28.427",
      "timerange_start" : "2019-09-11 10:03:22.453",
      "timerange_end" : "2019-09-11 10:08:22.452",
      "streams" : [
        "000000000000000000000002"
      ],
      "source_streams" : [
        "5d76240b945248b2f"
      ],
      "message" : "500_ErrorCodes: abc.graylog.com- count()=12.0",
      "source" : "graylog3-helm-0.graylog3-helm-svc.cluster.local",
      "key_tuple" : [],
      "key" : "",
      "priority" : 2,
      "alert" : false,
      "fields" : { }
    }

```

Below is the sample message with alert=true

```
    "_source" : {
      "id" : "01DMFN7WGAEB3TXTPRK",
      "event_definition_type" : "aggregation-v1",
      "event_definition_id" : "5d76470a026d94693",
      "origin_context" : null,
      "timestamp" : "2019-09-11 07:55:33.233",
      "timestamp_processing" : "2019-09-11 07:57:38.243",
      "timerange_start" : "2019-09-11 07:52:22.452",
      "timerange_end" : "2019-09-11 07:57:22.451",
      "streams" : [
        "000000000000000000000002"
      ],
      "source_streams" : [
        "5d76240b945248b2f"
      ],
      "message" : "500_ErrorCodes: def.graylog.com - count()=14.0",
      "source" : "graylog3-helm-0.graylog3-helm.svc.cluster.local",
      "key_tuple" : [],
      "key" : "",
      "priority" : 2,
      "alert" : true,
      "fields" : { }
    }

```

I am not able to understand how the graylog sets the **value of alert field to true or false**

I didn’t find much information on the alerts [documentation](http://docs.graylog.org/en/3.1/pages/streams/alerts.html#alerts)

Kindly share your thoughts and help us to understand the alerts concept.

Regards,  
Ganeshbabu R

---

<div class="post-metadata">

**Author:** ![Ganeshbabu](https://avatars.discourse-cdn.com/v4/letter/g/b487fb/32.png) [@Ganeshbabu](https://community.graylog.org/u/Ganeshbabu)\
**Post date:** [September 16, 2019, 6:39am UTC](https://community.graylog.org/t/how-graylog-set-alert-field-value-to-true-or-false/11960/2 "2019-09-16T06:39:30Z")

</div>

> [@Ganeshbabu](#):
>
> I am not able to understand how the graylog sets the **value of alert field to true or false**

If we add the notification in the event definition then alert field value set as “True” in the message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 30, 2019, 6:39am UTC](https://community.graylog.org/t/how-graylog-set-alert-field-value-to-true-or-false/11960/3 "2019-09-30T06:39:37Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.