1. Describe your incident: we have defined an alert based on an event. The filter we use yields several results and that is fine. The notification tab is configured to have a “Grace Period = 0” and “Message Backlog = 50” (at least for now). However, instead of getting 1 single email with a backlog of up to 50 error messages, I receive 1 email per message line… not cool. 2. Describe your environment: OS Information: Ubuntu 20.04 LTS Package Version: GL 4.3.9 + OpenSearch 1.3.3 Service logs, configurations, and environment variables: [image] [image] 3. What steps have you already taken to try and solve the problem? I found several posts about the same subject but they weren’t answered: [image] Aggregate Alerts into one mail Graylog Central (peer support) Hi, I am using Grylog for syslog monitoring. I have a situation where I need to configure alert for say Event-A, where I should alert (through email) only the FIRST syslog message from the source-A and ignore the rest of the messages from source-A for Event-A until I see a discontinuity (no messages for 1 minute). For this Event-A, I will get only 2 messages for 1 min. It is also exceptable to have 2 emails for the initial 2 messages. I have tried alert aggregation by source with the threshol… [image] Aggregate the same alerts into one mail Graylog Central (peer support) Hi All, Our developer team setting the application retry time = 0 That’s means if the error occur, we will receive so many alert mail. Are there any function can do the aggregate to one mail or filter the same alert? [image] Alert or Aggregates plugin searches for every 15 min only Graylog Central (peer support) I Have a messages from AWS-Cloud trail to Graylog2. Now Cloud trail sends data after every 7-10 min only. Now If I use eaither Alert Field Aggregate or directly the Aggregate plugin both looks for the message as (t - 10min) etc. i.e (current time - provided time in Interval field) So when I give any time less than 10min then I won’t even get any alert, But if I give 15 min I get an alert but this alert generates only after 15 min. So every half hour it works only 2 times. Instead is there any… and Search results for 'alert aggregation' - Graylog Community 4. How can the community help? How do you guys make it work? :slight_smile: Thanks!

This post Aggregating Events for Notification - #2 by Slair solved the issue. Thanks all!

There is a good explanation in one of the threads you listed: [image] Aggregate the same alerts into one mail Graylog Central (peer support) Hi All, Our developer team setting the application retry time = 0 That’s means if the error occur, we will receive so many alert mail. Are there any function can do the aggregate to one mail or filter the same alert?

[SOLVED] Event notifications not sending aggregated logs

Graylog Central (peer support)

patrickmann (Patrick Mann) November 18, 2022, 8:08am 2

There is a good explanation in one of the threads you listed:

Topic		Replies	Views
Problem with multiple line into Alert Graylog Central (peer support)	3	564	November 22, 2022
Aggregate the same alerts into one mail Graylog Central (peer support)	1	1035	May 25, 2022
Notifications being sent too frequently Graylog Central (peer support)	9	1421	January 17, 2020
Graylog 4.1.5 - Notifications - One Mail per Event - No Backlog Graylog Central (peer support)	7	999	October 20, 2021
Aggregate Alerts into one mail Graylog Central (peer support)	0	584	July 15, 2020

[SOLVED] Event notifications not sending aggregated logs

Related topics