Graylog stream

streams → rules → alert conditions

Creates a Graylog stream that filters events by rules and assigns alert conditions, routing the important stuff to the team.

Use it when you want to separate relevant traffic from noise in Graylog: the stream groups messages that match its rules (by field, source, content) and alert conditions trigger notifications when the threshold is exceeded. Typical case: a failed authentication stream that alerts when an IP exceeds N failures in 5 minutes, or a critical host stream with immediate alerting. It's the way to turn Graylog from a 'log finder' into a 'SIEM with alerts' without leaving the platform, and to prioritize what the team should look at.

Don't use it as a full SIEM: Graylog lacks the data model and advanced correlation of Splunk/ES — for complex incidents (multi-event chains) it falls short. Poorly designed stream rules (too broad) turn the stream into another pile of noise: define fields well and test the filter as a search before creating the stream. And watch performance: each stream evaluates all incoming messages; dozens of streams with heavy rules impact ingestion. Alert conditions require the stream to receive data — a stream without messages doesn't alert, and that could also be a pipeline issue, not an absence of attacks.