Hello!
I’d like to confirm the criteria by which the last messages are included to the backlog.
When I started the testing, I thought any messages after one that triggered the alert are to be sent, in descendent order.
But it seems only ones satisfying to the alert condition are included. In other words, if we have an alert such like this:
Message Count Alert Condition
Search Query: message: “Permission denied”
and the log is:
1: Permission denied
2: Some info
3. Some info
Then only the first string would be in the notification. And opposite, if the log is:
1: Permission denied
2: Permission denied
3. Permission denied
Then all strings would be in the notification.
Am I correct in my understanding of it?
Thanks!