Graylog2 / Graylog2/graylog2-server
New Alerting does not allow backlog messages
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The new alerting system is unable to pull any fields or data from a backlog, I spoke with Kay Roepke and he said that this may be a limitation of the ES API being used.
Specs:
Graylog 3.1 latest deb, Ubuntu 18.04
**Steps to reproduce:**
Create new Alert, set backlog >1
Include in Alert:
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
${end}
**Or subject:**
MITRE ATTACK Threat detected on${foreach backlog msg}${if first_msg} ${msg.source} ${else} ${end} ${end}
**Make alert go off, and view error in Graylog UI:**
The Graylog server encountered an error while trying to send an email. This is the detailed error message: ElasticsearchException{message=Unable to scroll indices. An HTTP line is larger than 4096 bytes., errorDetails=[An HTTP line is larger than 4096 bytes.]}
Contributor guide
Assessment
This issue has not been assessed yet.