Does it work on Graylog 3.0.0?

[airbus-cyber]

Does it work on Graylog 3.0.0?

[dlancelin]

Hi,

It should work, but I see in your configuration that the query parameter is empty.
Could you try with the parameter query set to * ?

[borjam]

I tried with query=* and it didn't work either.

Adding a backlog parameter seems to work. I understand that the backlog messages parameter is only used to determine how many messages to include in the notification alert? It seems to affect the actual number of messages examined.

So, if I set it to, for example, 20 minutes, and with a backlog of 10 messages it does work.

Curious.

I wonder. Is the message backlog only the number of messages to include with the alert, or is it actually a cap on the number of messages to evaluate?

In the latter case it would make sense (avoiding a sort of collapse in an error condition in which the number of events per second increase a lot) but it should be pointed out in the description ;)

[borjam]

Anyway, sorry for the belated update. It works on 3.0.0 although the documentation is a bit confusing.

[devicenull]

I agree with you here, the backlog description is very confusing. I was having the same issue here, alerts were not firing until I raised backlog.