Troubles with alert

[Sergei]

Hello!

I have messages:

1. time: 10:00:00, session: 1, blocking-session: 2
2. time: 10:00:00, session: 3, blocking-session: 4
3. time: 10:00:00, session: 5, blocking-session: 6
4. time: 10:00:20, session: 1, blocking-session: 2
5. time: 10:00:20, session: 5, blocking-session: 6
6. time: 10:00:40, session: 7, blocking-session: 8

I want to alert every 20 seconds if were the same pairs (session + blocking-session).
In my case I want to see 2 message:

1. session: 1 blocking-session: 2.
2. session: 5 blocking-session: 6

How I should make event defenition?

[dickinsonzach]

Good morning, are those messages received from a source? And if you receive them you want to trigger an alert?

You can start here:
https://docs.graylog.org/en/4.0/pages/alerts.html

You won’t be able to alert every 2 seconds. Best case is every minute, but that can be problematic as it may take more than a minute to parse you logs/inputs.

Thank you, Zach.