Notification is associated with stream not with condition

[derPhlipsi (Philipp Ruland)]

Hey @ryz.namathp,

your question was already asked in

Alert notifications should be bound to alert conditions instead of streams

Hello, First of all, this new forum looks great! Good job! I have long waited to see the renewed Alerts system in Graylog 2.2.0. I have done an upgrade to my test environment and I have been playing with the new alerts. So my concern is that alert notifications still seem to be bound to streams? I wish they would be bound to alert conditions, so that would allow custom and specific email messages based on the alert condition. For example (not a real-life scenario): There is a stream called S…

So, this will be the answer to your question:

Alert notifications should be bound to alert conditions instead of streams

Hej @hezor you are right, currently your given scenario is not possible. But we already have some feature issues on github that address this: https://github.com/Graylog2/graylog2-server/issues/3475 Additional the feature to be able to search on multiple streams with some virtual or meta stream would solve your issue https://github.com/Graylog2/graylog2-server/issues/3473 or at least give you an option how to solve this. Please feel free to add your use case to the issues to give them more …

The problem you are displaying is already known and triaged (as seen in the GitHub issue), it will probably be addressed sometime in the future (it is not assigned to a milestone yet).

Greetings - Phil