Graylog

• New alert or eventRuns for each new event or alert Graylog raises, oldest first, such as each high-priority alert, up to 50 a look. Events raised before the workflow is turned on don't run it.
• New messageRuns for each new log message that matches a search, oldest first, such as each failed login in a stream, up to 50 messages a look. Messages logged before the workflow is turned on don't run it.
• Message count crosses a thresholdRuns when the number of messages matching a search over the last few minutes goes above (or below) a threshold, such as more than 50 failed logins in 5 minutes, once per crossing. It runs again only after the count has come back.

• Search messagesFind the log messages that match a search, in the last few minutes or hours or between two times, newest first. Get each message with its time, source and the fields you choose, and all of them as text for an AI step or a message.
• Count messagesCount the messages that match a search in the last few minutes or hours, such as errors from one server in the last 15 minutes, in all or for each value of a field, to compare with a threshold.
• List streamsList the streams the token can see, with whether each is running or paused.
• Pause streamPause a stream, so messages stop being routed into it (and its alerts stop) until it is resumed, such as during planned maintenance.
• Resume streamResume a paused stream, so messages are routed into it again.
• List event definitionsList the event definitions (Graylog's alert rules) the token can see, with their priority and whether each is enabled.
• Search events and alertsFind the events and alerts Graylog raised in the last few minutes or hours, newest first: all of them, or only alerts, of one event definition, or from a priority up.
• Enable event definitionTurn an event definition on, so it searches on its schedule and raises events and alerts again.
• Disable event definitionTurn an event definition off, so it stops raising events and alerts, such as while a known problem is being fixed.
• Send log messageSend a message to Graylog through its GELF HTTP input, such as an audit trail of what a workflow did, with fields you choose. Needs the input's address on the connection.
• Get system statusCheck Graylog's health: whether it is running and processing messages, its search cluster's health (green, yellow or red), its nodes and its system notifications.

No actions match that.