Notification is associated with stream not with condition

[ryz.namathp (Rayees Namathponna)]

Here is my use case

Create one stream with 3 rules, I want to create multiple condition with this stream eg : one with

1st one with “Time Range = 60” and second one is “Time Range = 600” and third one is “Time Range = 3600”,

Also I want to generate e mail with all these 3 condition with different values like send list is diffrent also want to make some changes in URL

As per the current implementation is its not possible since email notification is associated with stream not with condition , only the work around is create mutiple stream and create different condition and diffrent notification, but this is expensive instead of one stream end up creating multiple streams.

Any suggestion and thoughts ?

[derPhlipsi (Philipp Ruland)]

Hey @ryz.namathp,

your question was already asked in

Alert notifications should be bound to alert conditions instead of streams

Hello, First of all, this new forum looks great! Good job! I have long waited to see the renewed Alerts system in Graylog 2.2.0. I have done an upgrade to my test environment and I have been playing with the new alerts. So my concern is that alert notifications still seem to be bound to streams? I wish they would be bound to alert conditions, so that would allow custom and specific email messages based on the alert condition. For example (not a real-life scenario): There is a stream called S…

So, this will be the answer to your question:

Alert notifications should be bound to alert conditions instead of streams

Hej @hezor you are right, currently your given scenario is not possible. But we already have some feature issues on github that address this: https://github.com/Graylog2/graylog2-server/issues/3475 Additional the feature to be able to search on multiple streams with some virtual or meta stream would solve your issue https://github.com/Graylog2/graylog2-server/issues/3473 or at least give you an option how to solve this. Please feel free to add your use case to the issues to give them more …

The problem you are displaying is already known and triaged (as seen in the GitHub issue), it will probably be addressed sometime in the future (it is not assigned to a milestone yet).

Greetings - Phil

[guido]

Hi,
As you can see alerts notifications are yet associated to Streams. As a workaround I’ve used aggregator plugin that permit to select specific notification defined for a stream. But you must use an old version < 2.1 because from 2.1 they have integrated the alert notification with native graylog one and so you’ve lost the most interesting option to select specific notification.

cheers