# Time based alerts

**URL:** https://community.graylog.org/t/time-based-alerts/21428
**Category:** Graylog Central (peer support)
**Tags:** pipeline-rules
**Created:** [October 11, 2021, 10:59pm UTC](https://community.graylog.org/t/time-based-alerts/21428 "2021-10-11T22:59:48Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![tor](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tor](https://community.graylog.org/u/tor)
#### Post date: [October 11, 2021, 10:59pm UTC](https://community.graylog.org/t/time-based-alerts/21428/1 "2021-10-11T22:59:49Z")

</div>

## Description of your problem

How can I create a alert and notification if someone logs into a sever outside normal office hours. 9am to 6.30pm normal hours. If out side these hours someone try to login then an alert is generated with a email notification.

So time based alerts.

### Operating system information

- CentOS 7.9

### Package versions

- Graylog 4.1.2

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [October 11, 2021, 11:08pm UTC](https://community.graylog.org/t/time-based-alerts/21428/2 "2021-10-11T23:08:22Z")

</div>

Hello,  
I think your referring to this? You may need to adjust the configurations to your needs.

> [@User logged in Outside Business Hours](https://community.graylog.org/t/user-logged-in-outside-business-hours/20690):
>
> I have to give respect to @jan for showing me this. This became the most importent Pipeline we use in multiply environments. rule "Between 6 PM and 6 AM" when ( to\_long(to\_date($message.timestamp, "American/Chicago").hourOfDay) \>= 0 AND to\_long(to\_date($message.timestamp, "American/Chicago").hourOfDay) \<= 6 ) OR ( to\_long(to\_date($message.timestamp, "American/Chicago").hourOfDay) \>= 18 AND to\_long(to\_date($message.timestamp, "American/Chicago").hourOfDay) \<= 0 ) then set\_field("trigger\_workh…

---

<div class="post-metadata">

### Author: ![tor](https://avatars.discourse-cdn.com/v4/letter/t/ecccb3/32.png) [@tor](https://community.graylog.org/u/tor)
#### Post date: [October 11, 2021, 11:13pm UTC](https://community.graylog.org/t/time-based-alerts/21428/3 "2021-10-11T23:13:45Z")

</div>

Yes that is what I’m looking for. How do I find out the time zone style that graylog accepts. So I’m UK london.

Is this a pipeline rule that I can import?

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [October 12, 2021, 12:27am UTC](https://community.graylog.org/t/time-based-alerts/21428/4 "2021-10-12T00:27:11Z")

</div>

> [@tor](#):
>
> How do I find out the time zone style that graylog accepts

Next time you can always look in your Graylog “server.conf” file [here](https://docs.graylog.org/docs/server-conf#:~:text=Default%20is%20empty.-,root_timezone%20%3D%20UTC,-The%20time%20zone)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4737bf53d2761c69c0f1d7b32cd4ac773a929e32.png)

The link inside your configuration file will lead you here.

[https://www.joda.org/joda-time/timezones.html](https://www.joda.org/joda-time/timezones.html)

Edit:

@tor

> [@tor](#):
>
> Is this a pipeline rule that I can import?

Example:

- Create a stream called “Windows: User Successful Logon Local”.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/44a1d71fec266f03300f693633405d109ea40c44.png)

- Create Pipeline and attach it to stream “Windows: User Successful Logon Local”.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/41fe227d65de7853c8b8e026f364fe52190e0387.png)

- Create the rules and set the stages.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/551ed007dd864cc571a0b33ecf7899cf71199ee4.png)

You may have to adjust these steps to your needs.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [October 26, 2021, 12:28am UTC](https://community.graylog.org/t/time-based-alerts/21428/5 "2021-10-26T00:28:06Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.