It’s Urgent please help me in this - Is there any way to mute stream alerts on non-prod hours i.e at night time. In our environment, we are getting alerts on Slack
- Is there any plugin for this?
- Can I mute all streams alerts through web-interface? Or
- Through API-Browser?
Graylog version - 2.4.6
Elasticsearch Version - 5.6
Thanks all in advance.
it is possible with a changed message processing. Because I did not know any plugin that would allow you to disable alerts for a given time you need to add a field to the messages that can act as a trigger - if the messages comes in during office our or not.
Like seen here: https://cdn.rawgit.com/jalogisch/OpenSourceDay2018/d3ffdebf/Presentation.html#29
But no “click and ready” solution.
@jan Thanks for the great info.
One question: We need to create Pipelining for this or its possible without pipelining ?
We need to create Pipelining for this or its possible without pipelining
No without Pipelines that is not possible.
@jan It means the field set_field(“trigger_alert”, true); only active when it meets the condition i.e
rule “Between 0 and 6 o’clock”
to_date($message.timestamp).hourOfDay >= 0 &&
to_date($message.timestamp).hourOfDay <= 6
And after the we need to set alert on field “trigger_alert” ?
You create a stream for the alert condition and only route the messages into this stream if trigger_alert is set.
Thanks @jan and I will try today.
@jan It’s giving error
What I need to change in the code if I want to apply rule from 4 AM PST to 7 PM PST
These are the fileds:
I sorted out by using the following code
rule "Pipeline on Timing"
to_long(to_date($message.timestamp).hourOfDay) >= 10 &&
to_long(to_date($message.timestamp).hourOfDay) <= 5
@jan I want to schedule from 10 AM UTC to 5 AM UTC i.e for 19 hours only but above code did’t work. I think it’s checking greater than value ie if i write
to_long(to_date($message.timestamp).hourOfDay) >= 5 && to_long(to_date($message.timestamp).hourOfDay) <= 10 then this will work. What I need to change in the code to schedule time between 10 AM UTC to 5 AM UTC.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.