Graylog2 / Graylog2/graylog2-server
Email Alert Callback Stream URL is broken/wrong/useless when event-triggertime is not logmessage-timestamptime
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Using graylog2-server 1.1.4:
In the default Email Alert Callback template a link to the stream is included with
```
${if stream_url}Stream URL: ${stream_url}${end}
```
This URL gets built in https://github.com/Graylog2/graylog2-server/blob/b776037c5eeece1e03fb2d7019f056ecd72862e2/graylog2-server/src/main/java/org/graylog2/alerts/StaticEmailAlertSender.java#L173-L178
Unfortunately the timestamps being put into said URL can be wrong, namely when the timestamps on the log lines that triggered this event are not the same as the time this event was triggered at. This leads to empty search results when following the generated link.
As an example, if the log sports a timestamp of 13:00:00 and for whatever reason does not arrive at graylog by 13:01:00, if that log line triggers an alert looking at a minute's worth of data, the generated URL will not lead to the log line in question since the timestamp in ElasticSearch is not within the time-period calculated from the event trigger.
This can happen when there is latency on the log processing chain or system clocks being weird or when doing maintenance on Graylog or its shippers (and thus processing log entries after the maintenance is over) or when backfilling or (...).
A fix would be to look at the min/max timestamps of the log messages being considered and building the stream_url based off of those. If that is intractable, a configurable time window for this URL generation should be provided (i.e. the ability to increase the window being sent from 1 minute to 10 minutes, for instance). As it stands, at least for our deployment, the links being generated are useless.
Contributor guide
Assessment
This issue has not been assessed yet.