Hi, guys! How can I use a logical OR operator in ‘Field content condition’? Is this possible to make something like ‘if event_id contains value ‘1’ or ‘2’ raise an alert’? Can someone help? [alert] I tried a lot of queries: (4720 OR 636), 4720 OR 636, ^(4720|636)$ and etc.

Logical OR in alert condition

ioneyaqoo (Ivan Yakushev) September 14, 2017, 11:15am 5

Thanks, G

I tested this scenario before and it works, but still need a lot of streams for each event group.

1 Like

Topic		Replies	Views
Field content alert condition more than one value? Graylog Central (peer support) pipeline-rules , sidecar , winlogbeat	6	2730	September 4, 2018
Alerts conditions for multiple field values Graylog Central (peer support)	1	1949	July 19, 2018
Stream and alert (condition) question Graylog Central (peer support)	8	776	May 28, 2019
Notification for each condition Graylog Central (peer support) pipeline-rules , route-to-streampl , sidecar , winlogbeat	5	886	May 21, 2019
Graylog alert conditions not triggered Graylog Central (peer support) sidecar , winlogbeat	3	523	May 31, 2019