Re: [graylog2] Gralylog alert not generating alert with actual number

[Rayees Namathponnan]

Hi Jochen,

I have added some more logs in my script, if you can run this you should be 
able identify the alerts missing, 

>>>  https://github.com/rayeesnp/graylog-performance/tree/master 
>>>  


> python log_gen.py -p 1 -t 3

above script run for 3 minute with one process, in each cycle it should 
generate 69 - 70 alerts, but atleast 5 alert missing in each cycle

Regards,
Rayees




> On Jan 25, 2017, at 11:18 AM, Rayees Namathponnan  
> wrote:
> 
> Hi Jochen,
> 
> My script generate 70 messages in one minute,  i.e. 70 messages pushed to 
> graylog in 1 minute,  
> 
> I think the issue is what ever the messages processed before the alert 
> trigger its getting added in alert, example 50 message received and process 
> in graylogm then this will be part of next alert and ignoring the remaining 
> 20.
> 
> also i can see all the 70 messages in graylog, i.e. if i do a search in 
> graylog after sometime, I can see all messages.
> 
> 
> Regards,
> Rayees
> 
> 
> 
> 
> 
>> On Jan 25, 2017, at 11:02 AM, Rayees Namathponnan > > wrote:
>> 
>> graylog version Graylog 2.1.2+50e449a
>> 
>> 
>>> On Jan 25, 2017, at 7:22 AM, Jochen Schalanda >> > wrote:
>>> 
>>> Hi Rayees,
>>> 
>>> which version of Graylog are you using?
>>> 
>>> Cheers,
>>> Jochen
>>> 
>>> On Monday, 23 January 2017 17:03:09 UTC+1, Rayees Namathponnan wrote:
>>> Hi All,
>>> 
>>> I have written a script to generate 501 message / second with 1 unique 
>>> string in 501 th to generate alert,  if you run the script it generate 
>>> messages  70 unique string and expecting an alert with message count is 70, 
>>>   but graylog always report only 60-65 messages, looks like some alerts as 
>>> missing in graylog, more details are below 
>>> 
>>> 
>>> Script 
>>> 
>>> 
>>> You can get script from 
>>> https://github.com/rayeesnp/graylog-performance/tree/master 
>>>  
>>> 
>>> There are two scripts one generate logs “log_gen.py” and  fl_app.py is 
>>> python flask app it can receive alert from graylog alert HTTP call back and 
>>> report number of alert received from graylog 
>>> 
>>> if you run this script, it will generate 500 message like message A  
>>> [random ip address before GET] and 1 message like B [ 
>>> hostname_process_string_uniquenumber ]
>>> 
>>> message a 
>>> ---
>>> 2017-01-19 19:00:01.612519 - sjelk34_0 - [218.193.16.244] "GET /wheelsets 
>>> HTTP/1.0" 200 3148 "http://bleater.com " "Mozilla/5.0 
>>> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36
>>> (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36"
>>> 
>>> message B 
>>> ---
>>> 2017-01-19 19:00:01.612573 - sjelk34_0 - [sjelk34_0_uni_68] "GET /wheelsets 
>>> HTTP/1.0" 200 4879 "http://bleater.com " "Mozilla/5.0 
>>> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) 
>>> Chrome/36.0.1944.0 Safari/537.36”
>>> 
>>> 
>>> 
>>> Graylog Configurations 
>>> ---
>>> File beat to collect log,  graylog collector log harvest log from /data/logs
>>> 
>>> Configured extractor to extract the the string “hostname_process", my cases 
>>> added regular expression “(sjvm34_0+)”, field contains the string 
>>> “sjvm34_0_uni”,  store as filed “message_tag_0”
>>> 
>>> Created stream rule with field tag “message_tag_0” contains “sjvm34_0”
>>> 
>>> In manage alert configure “Alert is triggered when there is more than one 
>>> message in the last 3 minutes. Grace period: 3 minutes.”
>>> 
>>> Then execute the script, by default script will execute 1 minute and 
>>> generate 70 unique script with sequence number, i am expecting alert 
>>> message with 70 message in alert,  but alert generating only for 60-65 
>>> messages.
>>> 
>>> 
>>> Regards,
>>> Rayees 
>>> 
>>> 
>>> 
>>> 
>>> 
>>> -- 
>>> You received this message because you are subscribed to the Google Groups 
>>> "Graylog Users" group.
>>> To unsubscribe from this group and stop receiving emails from it, send an 
>>> email to graylog2+unsubscr...@googlegroups.com 
>>> .
>>> To view this discussion on the web visit 
>>> https://groups.google.com/d/msgid/graylog2/a2faaee1-235a-448b-a8e6-79f74a15d916%40googlegroups.com
>>>  
>>> .
>>> For more options, visit https://groups.google.com/d/optout 
>>> .
>> 
> 

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 

Re: [graylog2] Gralylog alert not generating alert with actual number

[Rayees Namathponnan]

Hi Jochen,

My script generate 70 messages in one minute,  i.e. 70 messages pushed to 
graylog in 1 minute,  

I think the issue is what ever the messages processed before the alert trigger 
its getting added in alert, example 50 message received and process in graylogm 
then this will be part of next alert and ignoring the remaining 20.

also i can see all the 70 messages in graylog, i.e. if i do a search in graylog 
after sometime, I can see all messages.


Regards,
Rayees





> On Jan 25, 2017, at 11:02 AM, Rayees Namathponnan  
> wrote:
> 
> graylog version Graylog 2.1.2+50e449a
> 
> 
>> On Jan 25, 2017, at 7:22 AM, Jochen Schalanda > > wrote:
>> 
>> Hi Rayees,
>> 
>> which version of Graylog are you using?
>> 
>> Cheers,
>> Jochen
>> 
>> On Monday, 23 January 2017 17:03:09 UTC+1, Rayees Namathponnan wrote:
>> Hi All,
>> 
>> I have written a script to generate 501 message / second with 1 unique 
>> string in 501 th to generate alert,  if you run the script it generate 
>> messages  70 unique string and expecting an alert with message count is 70,  
>>  but graylog always report only 60-65 messages, looks like some alerts as 
>> missing in graylog, more details are below 
>> 
>> 
>> Script 
>> 
>> 
>> You can get script from 
>> https://github.com/rayeesnp/graylog-performance/tree/master 
>>  
>> 
>> There are two scripts one generate logs “log_gen.py” and  fl_app.py is 
>> python flask app it can receive alert from graylog alert HTTP call back and 
>> report number of alert received from graylog 
>> 
>> if you run this script, it will generate 500 message like message A  [random 
>> ip address before GET] and 1 message like B [ 
>> hostname_process_string_uniquenumber ]
>> 
>> message a 
>> ---
>> 2017-01-19 19:00:01.612519 - sjelk34_0 - [218.193.16.244] "GET /wheelsets 
>> HTTP/1.0" 200 3148 "http://bleater.com " "Mozilla/5.0 
>> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36
>> (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36"
>> 
>> message B 
>> ---
>> 2017-01-19 19:00:01.612573 - sjelk34_0 - [sjelk34_0_uni_68] "GET /wheelsets 
>> HTTP/1.0" 200 4879 "http://bleater.com " "Mozilla/5.0 
>> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) 
>> Chrome/36.0.1944.0 Safari/537.36”
>> 
>> 
>> 
>> Graylog Configurations 
>> ---
>> File beat to collect log,  graylog collector log harvest log from /data/logs
>> 
>> Configured extractor to extract the the string “hostname_process", my cases 
>> added regular expression “(sjvm34_0+)”, field contains the string 
>> “sjvm34_0_uni”,  store as filed “message_tag_0”
>> 
>> Created stream rule with field tag “message_tag_0” contains “sjvm34_0”
>> 
>> In manage alert configure “Alert is triggered when there is more than one 
>> message in the last 3 minutes. Grace period: 3 minutes.”
>> 
>> Then execute the script, by default script will execute 1 minute and 
>> generate 70 unique script with sequence number, i am expecting alert message 
>> with 70 message in alert,  but alert generating only for 60-65 messages.
>> 
>> 
>> Regards,
>> Rayees 
>> 
>> 
>> 
>> 
>> 
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Graylog Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to graylog2+unsubscr...@googlegroups.com 
>> .
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/graylog2/a2faaee1-235a-448b-a8e6-79f74a15d916%40googlegroups.com
>>  
>> .
>> For more options, visit https://groups.google.com/d/optout 
>> .
> 

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/200C25B8-1027-4E2F-9F68-53BEAFD0B84A%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Re: Gralylog alert not generating alert with actual number

[Rayees Namathponnan]

graylog version Graylog 2.1.2+50e449a


> On Jan 25, 2017, at 7:22 AM, Jochen Schalanda  wrote:
> 
> Hi Rayees,
> 
> which version of Graylog are you using?
> 
> Cheers,
> Jochen
> 
> On Monday, 23 January 2017 17:03:09 UTC+1, Rayees Namathponnan wrote:
> Hi All,
> 
> I have written a script to generate 501 message / second with 1 unique string 
> in 501 th to generate alert,  if you run the script it generate messages  70 
> unique string and expecting an alert with message count is 70,   but graylog 
> always report only 60-65 messages, looks like some alerts as missing in 
> graylog, more details are below 
> 
> 
> Script 
> 
> 
> You can get script from 
> https://github.com/rayeesnp/graylog-performance/tree/master 
>  
> 
> There are two scripts one generate logs “log_gen.py” and  fl_app.py is python 
> flask app it can receive alert from graylog alert HTTP call back and report 
> number of alert received from graylog 
> 
> if you run this script, it will generate 500 message like message A  [random 
> ip address before GET] and 1 message like B [ 
> hostname_process_string_uniquenumber ]
> 
> message a 
> ---
> 2017-01-19 19:00:01.612519 - sjelk34_0 - [218.193.16.244] "GET /wheelsets 
> HTTP/1.0" 200 3148 "http://bleater.com " "Mozilla/5.0 
> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36"
> 
> message B 
> ---
> 2017-01-19 19:00:01.612573 - sjelk34_0 - [sjelk34_0_uni_68] "GET /wheelsets 
> HTTP/1.0" 200 4879 "http://bleater.com " "Mozilla/5.0 
> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) 
> Chrome/36.0.1944.0 Safari/537.36”
> 
> 
> 
> Graylog Configurations 
> ---
> File beat to collect log,  graylog collector log harvest log from /data/logs
> 
> Configured extractor to extract the the string “hostname_process", my cases 
> added regular expression “(sjvm34_0+)”, field contains the string 
> “sjvm34_0_uni”,  store as filed “message_tag_0”
> 
> Created stream rule with field tag “message_tag_0” contains “sjvm34_0”
> 
> In manage alert configure “Alert is triggered when there is more than one 
> message in the last 3 minutes. Grace period: 3 minutes.”
> 
> Then execute the script, by default script will execute 1 minute and generate 
> 70 unique script with sequence number, i am expecting alert message with 70 
> message in alert,  but alert generating only for 60-65 messages.
> 
> 
> Regards,
> Rayees 
> 
> 
> 
> 
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Graylog Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to graylog2+unsubscr...@googlegroups.com 
> .
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/graylog2/a2faaee1-235a-448b-a8e6-79f74a15d916%40googlegroups.com
>  
> .
> For more options, visit https://groups.google.com/d/optout 
> .

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/E271DF30-B1EF-4B1F-81AF-AC43E2E240AC%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Complex Search in a Stream

[Tom Powers]

Gotcha...I was hoping that some of the more complex searches that one can write 
and save could simply be called and used by a stream

I'll dig into what pipelines can give me in that case

Thanks

Tp

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/9032e0f2-99ac-4542-856b-5812994a624a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: help input failing : graylog input format

[Jochen Schalanda]

Hi,

it sounds like there are still firewall rules in place which prevent the 
packets reaching Graylog.

Unfortunately we cannot help you to fix your networking setup, this is 
simply out of scope for this mailing list.

Cheers,
Jochen

On Wednesday, 25 January 2017 01:45:46 UTC+1, jony wrote:
>
> I apologize for the late answers ;but another thing is that i managed to 
> connect my firewall to my graylog but only through udp input, id i use tcp 
> ,nothing is received ,is there a way to solve this considering the fact 
> that tcp is more reliable than udp ,and that logs are important to save 
> Thank you 
>
> Le mardi 24 janvier 2017 08:21:11 UTC, Jochen Schalanda a écrit :
>>
>> Hi,
>>
>> how are you sending messages to Graylog? What's your network setup? Did 
>> you check your firewall rules and that the routing is correct?
>>
>> Did you check with Wireshark or a similar tool, if the messages actually 
>> reached Graylog?
>>
>> Cheers,
>> Jochen
>>
>> On Monday, 23 January 2017 23:35:13 UTC+1, jony wrote:
>>>
>>> i tried sending syslog tcp  and sending raw text tcp using a non 
>>> privileged port, both showed the message 'Running' however messages are 
>>> nowhere to be found ,and at the right top of the page ,i get 0 in/out 
>>> messages ; what do you think could be the cause ? other than that i get no 
>>> error message ,and the overview shows nothing
>>>
>>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/e526c655-f8f0-4a3f-bb15-424b057ace1a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Gralylog alert not generating alert with actual number

[Jochen Schalanda]

Hi Rayees,

which version of Graylog are you using?

Cheers,
Jochen

On Monday, 23 January 2017 17:03:09 UTC+1, Rayees Namathponnan wrote:
>
> Hi All,
>
> I have written a script to generate 501 message / second with 1 unique 
> string in 501 th to generate alert,  if you run the script it generate 
> messages  70 unique string and expecting an alert with message count is 70, 
>   but graylog always report only 60-65 messages, looks like some alerts as 
> missing in graylog, more details are below 
>
>
> Script 
> 
>
> You can get script from 
> https://github.com/rayeesnp/graylog-performance/tree/master 
>
> There are two scripts one generate logs “log_gen.py” and  fl_app.py is 
> python flask app it can receive alert from graylog alert HTTP call back and 
> report number of alert received from graylog 
>
> if you run this script, it will generate 500 message like message A 
>  [random ip address before GET] and 1 message like B [ 
> hostname_process_string_uniquenumber ]
>
> message a 
> ---
> 2017-01-19 19:00:01.612519 - sjelk34_0 - [218.193.16.244] "GET /wheelsets 
> HTTP/1.0" 200 3148 "http://bleater.com; "Mozilla/5.0 (Macintosh; Intel 
> Mac OS X 10_9_2) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36"
>
> message B 
> ---
> 2017-01-19 19:00:01.612573 - sjelk34_0 - [sjelk34_0_uni_68] "GET 
> /wheelsets HTTP/1.0" 200 4879 "http://bleater.com; "Mozilla/5.0 
> (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) 
> Chrome/36.0.1944.0 Safari/537.36”
>
>
>
> Graylog Configurations 
> ---
> File beat to collect log,  graylog collector log harvest log from 
> /data/logs
>
> Configured extractor to extract the the string “hostname_process", my 
> cases added regular expression “(sjvm34_0+)”, field contains the string 
> “sjvm34_0_uni”,  store as filed “message_tag_0”
>
> Created stream rule with field tag “message_tag_0” contains “sjvm34_0”
>
> In manage alert configure “Alert is triggered when there is more than one 
> message in the last 3 minutes. Grace period: 3 minutes.”
>
> Then execute the script, by default script will execute 1 minute and 
> generate 70 unique script with sequence number, i am expecting alert 
> message with 70 message in alert,  but alert generating only for 60-65 
> messages.
>
>
> Regards,
> Rayees 
>
>
>
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/a2faaee1-235a-448b-a8e6-79f74a15d916%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Alerts not getting triggered Graylog v2.0.1

[Jochen Schalanda]

Hi Rakesh,

please create a bug report for this 
at https://github.com/Graylog2/graylog2-server/issues and include all 
relevant information, such as your Graylog configuration, your alert 
definitions, and the contents of the "alerts" collection in MongoDB if 
possible.

Cheers,
Jochen

On Wednesday, 25 January 2017 04:11:18 UTC+1, Rakesh R wrote:
>
> Have upgraded graylog to latest version, still facing the same issue, the 
> alerts just stop being triggered. Every time the server has to be restarted 
> to make the graylog server trigger alerts. What could be the issue ?
>
> thanks
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/645cd45d-0bde-4595-be7d-8ac1c56524d2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog Processing

[Jochen Schalanda]

Hi Peter,

since there have to be some differences, you could start by comparing the 
MongoDB database contents. Although I'm not sure that's worth the effort.

See http://3t.io/blog/diff-mongodb/ for a tool which can possibly help you 
with that.

This being said, there's also a professional support offering, if you need 
further help with your setups: https://www.graylog.org/professional-support

Cheers,
Jochen

On Wednesday, 25 January 2017 11:10:04 UTC+1, Peter Griggs wrote:
>
> Hi Jochen,
>
> Both are on the same version, don't suppose you have any other ideas this 
> is driving me potty!
>
> Thanks
> Pete.
>
> On Friday, 20 January 2017 12:23:00 UTC, Jochen Schalanda wrote:
>>
>> Hi Peter,
>>
>> are the versions of Graylog identical?
>> Are you using any extractors?
>> Are you using any processing pipeline rules?
>>
>> Cheers,
>> Jochen
>>
>> On Friday, 20 January 2017 11:01:36 UTC+1, Peter Griggs wrote:
>>>
>>> Hi
>>>
>>> Both are identical. :-/
>>>
>>> 1 GeoIP Resolver active
>>> 2 Pipeline Processor active
>>> 3 Message Filter Chain active
>>> Cheers
>>> Pete.
>>>
>>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/39be8ad4-452c-411a-8c50-dd2590ed6451%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Graylog Processing

['Peter Griggs' via Graylog Users]

Hi Jochen,

Both are on the same version, don't suppose you have any other ideas this 
is driving me potty!

Thanks
Pete.

On Friday, 20 January 2017 12:23:00 UTC, Jochen Schalanda wrote:
>
> Hi Peter,
>
> are the versions of Graylog identical?
> Are you using any extractors?
> Are you using any processing pipeline rules?
>
> Cheers,
> Jochen
>
> On Friday, 20 January 2017 11:01:36 UTC+1, Peter Griggs wrote:
>>
>> Hi
>>
>> Both are identical. :-/
>>
>> 1 GeoIP Resolver active
>> 2 Pipeline Processor active
>> 3 Message Filter Chain active
>> Cheers
>> Pete.
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/5169e8e9-b9d1-4116-be50-d48191cb1dfb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Complex Search in a Stream

[Jochen Schalanda]

Hi Tom,

On Tuesday, 24 January 2017 20:44:53 UTC+1, Tom Powers wrote:
>
> What is the syntax to use a saved search in a Stream?  That is eluding me 
> right now
>

I'm not sure we're talking about the same things. Saved searches are simply 
stored search queries which can be loaded (not their results, though): 
http://docs.graylog.org/en/2.1/pages/queries.html#saved-searches

They are working exactly the same for streams.


Cheers,
Jochen

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/5aaf136f-74fb-49a6-a7d1-b6583b470726%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Replicate settings to second site

[Jochen Schalanda]

Hi Frank,

if you want to clone all settings, you have to use a MongoDB dump. If 
inputs/streams/dashboards/outputs are enough, take a look at content packs.

Cheers,
Jochen

On Tuesday, 24 January 2017 20:27:24 UTC+1, Frank wrote:
>
> Hi,
>
> I got two Graylog clusters running. On at the primary, and one at a 
> disaster site.
> Of course I don't want to have to do every change from the primary site 
> again on the DR site by hand.
> So I'm looking to get all settings (inputs, extractors ...) to the DR site 
> on a regular basis.
> What would be the preferred way to do this? A mongodb dump, write a script 
> that queries the API?
>
> Cheers,
> Frank
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/1b2e7aa8-b38e-43d5-9b16-90d958bad383%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.