Pipeline rule help

Hi !

I’ve been asked to create complex rules on the Graylog we already use, but I can’t find any starting point.

We use Opentext to store all our internal documentation. This Opentext is installed over IIS. We already collect IIS logs in Graylog and apply few basic rules.

We would like to trigger an alert when a user has done more than 10 of an action in the last 30 minutes.
(Like if an ip (field “c-ip”) has 10 (" objAction" “edit”) in a stream in the last 30 minutes.

I have used a stream selecting only the messages with the field “objAction=Edit” and a I have tried to do a rule source in a pipeline to count.

My idea is this one: if we receive a message, we get the ip of the message and we count all the messages containing this IP in the last 30 minutes (the stream only contains the last 30 minutes messages so this is a problem solved).

In the “exemples” on the right telling you all the commands you can do while writting a rule, I can’t found anything to count a string in the stream.

If someone have an answer, or specific documentation, it will help me a lot :slight_smile:

Thanks so much and I wish you a lovely day!

Hey shadows:

From everything I’ve learned, pipeline rules can only interact with a single message and can only interact with messages as they are being ingested into Graylog. You can’t use them the look across multiple messages or interact with historical data.

If anyone jumps in and says I’m wrong I’ll be glad to hear as it’ll greatly expand the capabilities I thought existed, but I do not believe it to be possible.


Thanks a lot for taking the time to awnser!

After a lot of research I have found that the plugin bellow does exactly what I wanted:

I’m quite sad no one knew this and told me about but nevermind it will help you and the other people.

@Shadows Yes, the Aggregates plugin will allow you to do a lot of cool stuff with alerting.

I install the plugin on every graylog system I use, very useful. It’s actively maintained and kept up-to-date as well, which is brilliant.

If you’re able to mark your own response in this thread as the solution, please do. :slight_smile:

Okay brilliant I shall do that thanks :slight_smile:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.