Rules from Stream strange work

Guys help please!!! My chief wants killing me ))). Problem is next…
I set regular expression rules in the stream. Then I connected the stream in condition, where I turned on the telegram notification - now the problem is: Each event in the request, it sends to telegrams and this is too much, we need to respond only to those that I specified in the rules + so that it sends one at a time , and not every second, for example, it reached 5 messages, sent to telegram 1, reached 20 messages, sent to telegram 1. For some reason, after I updated the new versions, everything works poorly, maybe I need to completely recreate the streams with the rules … .

Thanks if you help !!!

Hi @JackRepos2018,

from what I am reading you try to solve something with streams which should be solved with Alerts. Please take your time and have a look at alerts. I think it would also makes sense to upgrade to 3.2 which would help you with the multiple condition problem. But I am not 100% sure.

In Alerts you can have a grace period, which should prevent you from sending a notification for every incoming alert.

I might get you wrong so please clarify if I missunderstood your problem.

Best regards,

Yeah i tried to understood - work my rules from stream or not with regular expressions. Our version is 3.2 now!!!
And about Alerts Grace period - i set 0. And 1 in Message Backlog. So maybe i need Grace period set up for are hours ? But then we received many alerts too???

Maybe who can connecting to my RDP screen… And change settings on One of my Alert devices to definition that send One message after received in stream device…

Next screen

Please look at the second screen where on right side we see many Events sNMP…linkDown, for 1 hour we have many messages from tcp ports, and that every message alerting to telegram. Our tasks is:
This message from ports send once…

Did you not have ideas anybody about my topic? Please maybe who knows some really worked solution in settings of GrayLog Alert

Hi @JackRepos2018,

I did not got a notification that you answered. So from what I understand you try to get a notification per port once right? This not quite possible. But please have a look at what I described here:

This will reduce the amount of messages send for one field.

Best regards,

Well @konrad, then one last question, in Stream I set up the rules according to which the event should look at my request and not send some noisy messages from devices, but they are still sent, I can’t understand what’s wrong, look at the screenshot please


I do not understand your question? Can you please be a bit more clear what is not working?

Best regards,

@konrad. Ok, Please look at the screen. I talk about those rules. I create it and want that they work, but they didn’t worked and regular expressions too, All messages in those rules we received on telegram and email, but I would like to exclude some with regular expression help!!! Question - Why rules don’t work in the streams maybe you know?

Our devices is Juniper.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.