Graylog2 / Graylog2/graylog2-server
Allow Notifications to be called directly from pipeline
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
So today in our Graylog environment we witnessed several messages, all properly tagged, not trigger an alert. The issue is that the messages were delivered late to the cluster (they were delivered late, thus processed a significant amount of time beyond their timestamp). Thus, as Graylog is running the searches every minute **based on the timestamp of the message** (field content, field 'alert' = 'autotick'), they were not seen in the Graylog alert engine and thus an alert was not fired for those messages.
To prevent such tragedies from occurring in the future, I would like to ask for a new feature - allowing alert notifications to be triggered directly from the pipeline (and allowing notifications to not be bound explicitly to streams). We are already writing complex, compound conditionals in the pipelines prior to inserting the messages into streams, only to subject them to yet another arbitrary conditional before firing the alert. Why can we not skip that secondary condition process and call one of our notifications directly from the pipeline? Sure it's not stateful, but it's surely better than missing an important event.
* Graylog Version: 2.4.4+4659dbe
* Elasticsearch Version: 5.6.9-1
* MongoDB Version: 3.4.14-1.el7
* Operating System: Red Hat Enterprise Linux Server release 7.5 (Maipo)
* Browser version: Google Chrome 66.0.3359.139 on Windows 10
Contributor guide
Assessment
This issue has not been assessed yet.