Graylog2 / Graylog2/graylog2-server

New Alerting does not allow backlog messages

Open
#6,334 1 comment 0 reactions 1 assignee Claimed by @mpfz0r View on GitHub
alerting bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

The new alerting system is unable to pull any fields or data from a backlog, I spoke with Kay Roepke and he said that this may be a limitation of the ES API being used.

Specs:
Graylog 3.1 latest deb, Ubuntu 18.04

**Steps to reproduce:**
Create new Alert, set backlog >1
Include in Alert:
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
${end}
**Or subject:**
MITRE ATTACK Threat detected on${foreach backlog msg}${if first_msg} ${msg.source} ${else} ${end} ${end}
**Make alert go off, and view error in Graylog UI:**
The Graylog server encountered an error while trying to send an email. This is the detailed error message: ElasticsearchException{message=Unable to scroll indices. An HTTP line is larger than 4096 bytes., errorDetails=[An HTTP line is larger than 4096 bytes.]}

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.