Create alert based on percentage thresholds

[asachs01]

What?

As a Graylog operator, I want to be able create an alert based on a percentage threshold of logs with a specific HTTP status code. For example:

• Logs are sent to Graylog from an application with an HTTP status code
• The status codes vary from 200 (Success), 400 (Bad Request), 500 (Internal Server Error)
• Events should be triggered if status codes 500 or 400 are 25% or above of 200 or total log count
• Alerts should be triggered if status codes 500 or 400 are 50% or above of 200 or total log count

Why?

This is out of a request in Z-4653. Please see that for additional context, if needed.

[damianharouff]

We've had a customer request this functionality via HS-1482495920.