{"action":"closed","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/1144","labels_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/1144/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/1144/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-web-interface/issues/1144/events","html_url":"https://github.com/Graylog2/graylog2-web-interface/issues/1144","id":59250679,"number":1144,"title":"Stream Alerts with custom conditions","user":{"login":"razvanphp","id":4599319,"avatar_url":"https://avatars.githubusercontent.com/u/4599319?v=3","gravatar_id":"","url":"https://api.github.com/users/razvanphp","html_url":"https://github.com/razvanphp","followers_url":"https://api.github.com/users/razvanphp/followers","following_url":"https://api.github.com/users/razvanphp/following{/other_user}","gists_url":"https://api.github.com/users/razvanphp/gists{/gist_id}","starred_url":"https://api.github.com/users/razvanphp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/razvanphp/subscriptions","organizations_url":"https://api.github.com/users/razvanphp/orgs","repos_url":"https://api.github.com/users/razvanphp/repos","events_url":"https://api.github.com/users/razvanphp/events{/privacy}","received_events_url":"https://api.github.com/users/razvanphp/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-27T15:29:47Z","updated_at":"2015-02-27T17:36:46Z","closed_at":"2015-02-27T17:36:46Z","body":"Hi,\r\n\r\nThis might be a feature request, so I'm not sure if it belongs to the web interface or the server, feel free to move it if necessary.\r\n\r\nIn our graylog v1.0 setup we use email alerts, and something really useful for us is missing or we don't know how to do, and that is, alerts based on conditions.\r\n\r\nTo explain the environment, we have multiple teams (about 8) and each team has more or less few streams, divided in environments: live, staging, dev. In the live stream, we collect for example both HTTP logs and PHP info and errors, since they are strongly connected. \r\n\r\nSetting up an alert for live stream does not work out of the box, because increased number of messages would not necessarily mean an error, just increased traffic. Our current workaround is to have a separate error stream that triggers the error. This cannot be used practically, because if each team creates so many streams, we will be lost in finding the one we need on the page.\r\n\r\nFor example, I would like to have something like message count condition only for response_code:500 OR level:<4.\r\n\r\nThank you for your great work!\r\n\r\nCheers from Hamburg"}}