Wrong Alert generated #2264
Closed
Wrong Alert generated #2264
Comments
At what time did the index cycling take place? |
There is logs from graylog:
And Alert message Date: 2016-05-19T15:00:20.372Z (or 2016-05-19T18:00:20.372+03:00 in local time) |
So the situation is that an alert was generated, because to Graylog it seemed as if that specific message was not there for the last day. It was contained in an index though, that was just in the middle of being rotated due to index rotation and alert checking happening at the same time. Am I correct? |
yep |
dennisoelkers
added a commit
that referenced
this issue
May 24, 2016
Thanks for supplying the valuable information, a fix was created. After it has been reviewed, we will decide in which one of the future versions it will be released. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Problem description
Just got wrong Alert.
Alert definition:

Alert query generated correctly and it finds item:
messages?rangetype=absolute&from=2016-05-18T15:00:20.372Z&to=2016-05-19T15:00:20.372Z&q=*
And it correctly finds message at 2016-05-19T03:08:09.780ZAnd I assured, that this message was here before Alert generated.
I've checked logs, but there is no errors.
Only thing I've mentioned, is that just at time of Alert there was index cycling procedure.
And the message was exactly from cycled index (message from graylog2_100 and cycling was from graylog2_100 to graylog2_101)
Environment
The text was updated successfully, but these errors were encountered: