To mute whole streams alerts on non prod hours


(Tafsir) #1

Hi All,

It’s Urgent please help me in this - Is there any way to mute stream alerts on non-prod hours i.e at night time. In our environment, we are getting alerts on Slack

  1. Is there any plugin for this?
  2. Can I mute all streams alerts through web-interface? Or
  3. Through API-Browser?

Graylog version - 2.4.6
Elasticsearch Version - 5.6

Thanks all in advance.


(Jan Doberstein) #2

it is possible with a changed message processing. Because I did not know any plugin that would allow you to disable alerts for a given time you need to add a field to the messages that can act as a trigger - if the messages comes in during office our or not.

Like seen here: https://cdn.rawgit.com/jalogisch/OpenSourceDay2018/d3ffdebf/Presentation.html#29

But no “click and ready” solution.


(Tafsir) #3

@jan Thanks for the great info.

One question: We need to create Pipelining for this or its possible without pipelining ?


(Jan Doberstein) #4

We need to create Pipelining for this or its possible without pipelining

No without Pipelines that is not possible.


(Tafsir) #5

@jan It means the field set_field(“trigger_alert”, true); only active when it meets the condition i.e

rule “Between 0 and 6 o’clock”

when
  to_date($message.timestamp).hourOfDay >= 0 && 
  to_date($message.timestamp).hourOfDay <= 6

?

And after the we need to set alert on field “trigger_alert” ?


(Jan Doberstein) #6

You create a stream for the alert condition and only route the messages into this stream if trigger_alert is set.


(Tafsir) #7

Thanks @jan and I will try today.


(Tafsir) #8

@jan It’s giving error

What I need to change in the code if I want to apply rule from 4 AM PST to 7 PM PST

These are the fileds:


(Tafsir) #9

I sorted out by using the following code

rule "Pipeline on Timing"
when
  to_long(to_date($message.timestamp).hourOfDay) >= 10 &&
  to_long(to_date($message.timestamp).hourOfDay) <= 5 

then
  set_field("Pipeline_Triggered_Condition", true);
end

@jan I want to schedule from 10 AM UTC to 5 AM UTC i.e for 19 hours only but above code did’t work. I think it’s checking greater than value ie if i write to_long(to_date($message.timestamp).hourOfDay) >= 5 && to_long(to_date($message.timestamp).hourOfDay) <= 10 then this will work. What I need to change in the code to schedule time between 10 AM UTC to 5 AM UTC.

Thanks


(system) #10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.