Graylog2 / Graylog2/graylog2-server

Allow Notifications to be called directly from pipeline

Open
#4,772 0 comments 0 reactions 0 assignees View on GitHub
alerting feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

So today in our Graylog environment we witnessed several messages, all properly tagged, not trigger an alert. The issue is that the messages were delivered late to the cluster (they were delivered late, thus processed a significant amount of time beyond their timestamp). Thus, as Graylog is running the searches every minute **based on the timestamp of the message** (field content, field 'alert' = 'autotick'), they were not seen in the Graylog alert engine and thus an alert was not fired for those messages.

To prevent such tragedies from occurring in the future, I would like to ask for a new feature - allowing alert notifications to be triggered directly from the pipeline (and allowing notifications to not be bound explicitly to streams). We are already writing complex, compound conditionals in the pipelines prior to inserting the messages into streams, only to subject them to yet another arbitrary conditional before firing the alert. Why can we not skip that secondary condition process and call one of our notifications directly from the pipeline? Sure it's not stateful, but it's surely better than missing an important event.

* Graylog Version: 2.4.4+4659dbe
* Elasticsearch Version: 5.6.9-1
* MongoDB Version: 3.4.14-1.el7
* Operating System: Red Hat Enterprise Linux Server release 7.5 (Maipo)
* Browser version: Google Chrome 66.0.3359.139 on Windows 10

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.