Graylog2 / Graylog2/graylog2-server
Add event definition suppression status / setting
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
Add a suppression feature for event definitions. This is similar to the notification grace period, but would prevent the suppressed generated events from being presented to users in Graylog's "Alerts & Events" view.
This will allow users to define a suppression period which will be applied after an event definition fires and generates an event - all subsequent finding with the same "key" fields will be suppressed until the configured suppression period lapses. This value should be configurable by the user in Illuminate-provided event definitions.
The events would still be generated and stored in the events index, but with a "suppressed" status.
It would be helpful to notify users that if no key fields are identified that all events for that event definition will be suppressed during the suppression period.
## Why?
The goal of this is to aid with the reduction of alert noise. We configure event definition periods (how often an event definition search is run) primarily to consider the potential search load in a typical environment, but for high volume source events the potential exists for this to generate a high volume of generated events in the event stream, and for the customers to deal with.
Having a suppression period will assist users in dealing with noisy event definitions without introducing potential blind spots if we were to suppress event generation completely.
## Your Environment
* Graylog Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Research direction
Start by tracing how event definitions fire, generate events, and present them in Graylog's Alerts & Events view, then compare the existing notification grace-period behavior. Done means defining a user-configurable suppression period and key-field behavior while retaining generated events in the events index with a suppressed status and explaining the no-key-fields case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, observability-sre
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100