Graylog2 / Graylog2/graylog2-server

Add event definition suppression status / setting

Open
#27,367 0 comments 1 reaction 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

Add a suppression feature for event definitions. This is similar to the notification grace period, but would prevent the suppressed generated events from being presented to users in Graylog's "Alerts & Events" view.

This will allow users to define a suppression period which will be applied after an event definition fires and generates an event - all subsequent finding with the same "key" fields will be suppressed until the configured suppression period lapses. This value should be configurable by the user in Illuminate-provided event definitions.

The events would still be generated and stored in the events index, but with a "suppressed" status.

It would be helpful to notify users that if no key fields are identified that all events for that event definition will be suppressed during the suppression period.

## Why?

The goal of this is to aid with the reduction of alert noise. We configure event definition periods (how often an event definition search is run) primarily to consider the potential search load in a typical environment, but for high volume source events the potential exists for this to generate a high volume of generated events in the event stream, and for the customers to deal with.

Having a suppression period will assist users in dealing with noisy event definitions without introducing potential blind spots if we were to suppress event generation completely.

## Your Environment

* Graylog Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Research direction

Start by tracing how event definitions fire, generate events, and present them in Graylog's Alerts & Events view, then compare the existing notification grace-period behavior. Done means defining a user-configurable suppression period and key-field behavior while retaining generated events in the events index with a suppressed status and explaining the no-key-fields case.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.