How to add an alerting for a source that is not sending logs to graylog

Graylog Central (peer support)
1

1. Describe your incident:
I have seen several posts for this question but none of them really works for me.
I need to add an alerting for a source that is not sending logs to graylog. We have a large kubernetes environment with more than 1000+ nodes. So creating streams for each of these nodes is tedious. I also saw like a content pack for this but unfortunately that link is not working. (issue mentioned here )

Does any one help me to get a working solution for this ?

Here is my environemnt details
Graylog running on Kubenetetes
Graylog 3.0.1+de74b68 on (Oracle Corporation 1.8.0_212 on Linux 5.16.12-1.el7.elrepo.x86_64)

2

Can anyone help me here ?

3

If you are using graylog open there are really only two options. Create an individual event for each source, make it an aggregation event of count <1. You could aldo make a single event that uses an aggregation to count the distinct sources but that would only tell you that some source isnt sending, not which one.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.