I need to create an alert that matches a string which is pretty easy. However, the string can also contain one of 10 IP addresses. Is it possible to match 5 alerts from the same IP address without having to write an alert for each one?
For example, match 5 alerts in 5 minutes from message pattern "here is the log" while I am receiving similar logs from 10 other IP addresses:
10.10.10.1 here is the log --1
10.10.10.2 here is the log
10.10.10.1 here is the log --2
10.10.10.6 here is the log
10.10.10.5 here is the log
10.10.10.4 here is the log
10.10.10.3 here is the log
10.10.10.1 here is the log --3
10.10.10.93 here is the log
10.10.10.87 here is the log
10.10.10.1 here is the log --4
10.10.10.1 here is the log --5 --> Send an email if the 5th time was received in 5 minutes.
It could be possible for 10.10.10.2 to send 5 logs in 5 minutes and I would want to send an email then as well. However, if an IP does not send a certain amount of the same log in 5 minutes, we will not alert. I am trying to accomplish 2 things:
1. Do not write more than 1 alert.
2. send an email if 5 logs are received from the same IP address (any of 10 IP addresses) within 5 minutes; do not send an email if the same syslog is received from different IP addresses in the same time frame.
Thanks,
Alex
