To mute whole streams alerts on non prod hours

Graylog Central (peer support)
1

Hi All,

It’s Urgent please help me in this - Is there any way to mute stream alerts on non-prod hours i.e at night time. In our environment, we are getting alerts on Slack

  1. Is there any plugin for this?
  2. Can I mute all streams alerts through web-interface? Or
  3. Through API-Browser?

Graylog version - 2.4.6
Elasticsearch Version - 5.6

Thanks all in advance.

2

it is possible with a changed message processing. Because I did not know any plugin that would allow you to disable alerts for a given time you need to add a field to the messages that can act as a trigger - if the messages comes in during office our or not.

Like seen here: https://cdn.rawgit.com/jalogisch/OpenSourceDay2018/d3ffdebf/Presentation.html#29

But no “click and ready” solution.

3

@jan Thanks for the great info.

One question: We need to create Pipelining for this or its possible without pipelining ?

4

We need to create Pipelining for this or its possible without pipelining

No without Pipelines that is not possible.

5

@jan It means the field set_field(“trigger_alert”, true); only active when it meets the condition i.e

rule “Between 0 and 6 o’clock”

when
  to_date($message.timestamp).hourOfDay >= 0 && 
  to_date($message.timestamp).hourOfDay <= 6

?

And after the we need to set alert on field “trigger_alert” ?

6

You create a stream for the alert condition and only route the messages into this stream if trigger_alert is set.

7

Thanks @jan and I will try today.

8

@jan It’s giving error

30%20PM
Screen Shot 2018-11-14 at 2.04.30 PM.png1894×570 49.8 KB

What I need to change in the code if I want to apply rule from 4 AM PST to 7 PM PST

01%20PM
Screen Shot 2018-11-14 at 2.07.01 PM.png1704×420 51.2 KB

These are the fileds:

08%20PM
Screen Shot 2018-11-14 at 2.11.08 PM.png1391×473 52.6 KB

9

I sorted out by using the following code

rule "Pipeline on Timing"
when
  to_long(to_date($message.timestamp).hourOfDay) >= 10 &&
  to_long(to_date($message.timestamp).hourOfDay) <= 5 

then
  set_field("Pipeline_Triggered_Condition", true);
end

@jan I want to schedule from 10 AM UTC to 5 AM UTC i.e for 19 hours only but above code did’t work. I think it’s checking greater than value ie if i write to_long(to_date($message.timestamp).hourOfDay) >= 5 && to_long(to_date($message.timestamp).hourOfDay) <= 10 then this will work. What I need to change in the code to schedule time between 10 AM UTC to 5 AM UTC.

Thanks

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.