Examples with AlertCondition org.graylog2.plugin.alarms.AlertCondition used on opensource projects

Example 6 with AlertCondition

use of org.graylog2.plugin.alarms.AlertCondition in project graylog2-server by Graylog2.

the class StreamFacade method decode.

private NativeEntity<Stream> decode(EntityV1 entity, Map<String, ValueReference> parameters, Map<EntityDescriptor, Object> nativeEntities, User user) {
    final StreamEntity streamEntity = objectMapper.convertValue(entity.data(), StreamEntity.class);
    final CreateStreamRequest createStreamRequest = CreateStreamRequest.create(streamEntity.title().asString(parameters), streamEntity.description().asString(parameters), // ignored
    null, null, streamEntity.matchingType().asString(parameters), streamEntity.removeMatches().asBoolean(parameters), indexSetService.getDefault().id());
    final Stream stream = streamService.create(createStreamRequest, user.getName());
    final List<StreamRule> streamRules = streamEntity.streamRules().stream().map(streamRuleEntity -> createStreamRuleRequest(streamRuleEntity, parameters)).map(request -> streamRuleService.create(DUMMY_STREAM_ID, request)).collect(Collectors.toList());
    // TODO: The creation of legacy alert conditions should be avoided and a new event definition should be created instead
    final List<AlertCondition> alertConditions = streamEntity.alertConditions().stream().map(alertCondition -> createStreamAlertConditionRequest(alertCondition, parameters)).map(request -> {
        try {
            return streamAlertService.fromRequest(request, stream, user.getName());
        } catch (ConfigurationException e) {
            throw new ContentPackException("Couldn't create entity " + entity.toEntityDescriptor(), e);
        }
    }).collect(Collectors.toList());
    // TODO: The creation of legacy alarm callback should be avoided and a new event notification should be created instead
    final List<AlarmCallbackConfiguration> alarmCallbacks = streamEntity.alarmCallbacks().stream().map(alarmCallback -> createStreamAlarmCallbackRequest(alarmCallback, parameters)).map(request -> alarmCallbackConfigurationService.create(stream.getId(), request, user.getName())).collect(Collectors.toList());
    final String savedStreamId;
    try {
        savedStreamId = streamService.saveWithRulesAndOwnership(stream, streamRules, user);
        for (final AlertCondition alertCondition : alertConditions) {
            streamService.addAlertCondition(stream, alertCondition);
        }
        for (final AlarmCallbackConfiguration alarmCallback : alarmCallbacks) {
            alarmCallbackConfigurationService.save(alarmCallback);
        }
    } catch (ValidationException e) {
        throw new ContentPackException("Couldn't create entity " + entity.toEntityDescriptor(), e);
    }
    final Set<ObjectId> outputIds = streamEntity.outputs().stream().map(valueReference -> valueReference.asString(parameters)).map(ModelId::of).map(modelId -> EntityDescriptor.create(modelId, ModelTypes.OUTPUT_V1)).map(descriptor -> findOutput(descriptor, nativeEntities)).map(Output::getId).map(ObjectId::new).collect(Collectors.toSet());
    streamService.addOutputs(new ObjectId(savedStreamId), outputIds);
    if (!alertConditions.isEmpty() || !alarmCallbacks.isEmpty()) {
        // TODO: Remove migration call once we updated the above code to directly create event definitions and notifications
        try {
            legacyAlertsMigration.upgrade();
        } catch (Exception e) {
            LOG.error("Couldn't run migration for newly created legacy alert conditions and/or alarm callbacks", e);
        }
    }
    return NativeEntity.create(entity.id(), savedStreamId, TYPE_V1, stream.getTitle(), stream);
}

Example 7 with AlertCondition

use of org.graylog2.plugin.alarms.AlertCondition in project graylog2-server by Graylog2.

the class StreamAlertResource method checkConditions.

@GET
@Timed
@Path("check")
@ApiOperation(value = "Check for triggered alert conditions of this streams. Results cached for " + REST_CHECK_CACHE_SECONDS + " seconds.")
@Produces(MediaType.APPLICATION_JSON)
@ApiResponses(value = { @ApiResponse(code = 404, message = "Stream not found."), @ApiResponse(code = 400, message = "Invalid ObjectId.") })
public Map<String, Object> checkConditions(@ApiParam(name = "streamId", value = "The ID of the stream to check.", required = true) @PathParam("streamId") String streamId) throws NotFoundException {
    checkPermission(RestPermissions.STREAMS_READ, streamId);
    final Stream stream = streamService.load(streamId);
    final Map<String, Object> result;
    try {
        result = CACHE.get(CACHE_KEY_BASE + stream.getId(), () -> {
            final List<AlertCondition> alertConditions = streamService.getAlertConditions(stream);
            int triggered = 0;
            final List<Map<String, Object>> results = new ArrayList<>(alertConditions.size());
            for (AlertCondition alertCondition : alertConditions) {
                final Map<String, Object> conditionResult = new HashMap<>();
                conditionResult.put("condition", alertCondition);
                final AlertCondition.CheckResult checkResult = alertCondition.runCheck();
                conditionResult.put("triggered", checkResult.isTriggered());
                if (checkResult.isTriggered()) {
                    triggered++;
                    conditionResult.put("alert_description", checkResult.getResultDescription());
                }
                results.add(conditionResult);
            }
            return ImmutableMap.of("results", results, "calculated_at", Tools.getISO8601String(Tools.nowUTC()), "total_triggered", triggered);
        });
    } catch (ExecutionException e) {
        final Throwable rootCause = Throwables.getRootCause(e);
        LOG.error("Could not check for alerts.", rootCause);
        throw new InternalServerErrorException(rootCause);
    }
    return result;
}

Example 8 with AlertCondition

use of org.graylog2.plugin.alarms.AlertCondition in project graylog2-server by Graylog2.

the class AlarmCallbackHistoryServiceImplTest method testSuccess.

@Test
public void testSuccess() throws Exception {
    final AlarmCallbackConfiguration alarmCallbackConfiguration = mockAlarmCallbackConfiguration(new Date());
    final Alert alert = mockAlert();
    final AlertCondition alertCondition = mockAlertCondition();
    final AlarmCallbackHistory alarmCallbackHistory = this.alarmCallbackHistoryService.success(alarmCallbackConfiguration, alert, alertCondition);
    verifyAlarmCallbackHistory(alarmCallbackHistory, alert, alertCondition);
    assertThat(alarmCallbackHistory.result()).isNotNull().isInstanceOf(AlarmCallbackSuccess.class);
    assertThat(alarmCallbackHistory.result().type()).isEqualTo("success");
}

Example 9 with AlertCondition

use of org.graylog2.plugin.alarms.AlertCondition in project graylog2-server by Graylog2.

the class HTTPAlarmCallbackTest method callThrowsAlarmCallbackExceptionIfURLIsMalformed.

@Test
public void callThrowsAlarmCallbackExceptionIfURLIsMalformed() throws Exception {
    final Configuration configuration = new Configuration(ImmutableMap.of("url", "!FOOBAR"));
    alarmCallback.initialize(configuration);
    final Stream stream = new StreamMock(Collections.singletonMap("_id", "stream-id"));
    final AlertCondition alertCondition = new DummyAlertCondition(stream, "alert-id", new DateTime(2017, 3, 29, 12, 0, DateTimeZone.UTC), "user", Collections.emptyMap(), "title");
    final AlertCondition.CheckResult checkResult = new AbstractAlertCondition.CheckResult(true, alertCondition, "Result Description", new DateTime(2016, 9, 6, 17, 0, DateTimeZone.UTC), Collections.emptyList());
    expectedException.expect(AlarmCallbackException.class);
    expectedException.expectMessage("Malformed URL: !FOOBAR");
    alarmCallback.call(stream, checkResult);
}

Example 10 with AlertCondition

use of org.graylog2.plugin.alarms.AlertCondition in project graylog2-server by Graylog2.

the class HTTPAlarmCallbackTest method callThrowsAlarmCallbackExceptionIfRemoteServerReturnsError.

@Test
public void callThrowsAlarmCallbackExceptionIfRemoteServerReturnsError() throws Exception {
    when(whitelistService.isWhitelisted(anyString())).thenReturn(true);
    server.enqueue(new MockResponse().setResponseCode(500));
    server.start();
    final Configuration configuration = new Configuration(ImmutableMap.of("url", server.url("/").toString()));
    alarmCallback.initialize(configuration);
    alarmCallback.checkConfiguration();
    final Stream stream = new StreamMock(Collections.singletonMap("_id", "stream-id"));
    final AlertCondition alertCondition = new DummyAlertCondition(stream, "alert-id", new DateTime(2017, 3, 29, 12, 0, DateTimeZone.UTC), "user", Collections.emptyMap(), "title");
    final AlertCondition.CheckResult checkResult = new AbstractAlertCondition.CheckResult(true, alertCondition, "Result Description", new DateTime(2016, 9, 6, 17, 0, DateTimeZone.UTC), Collections.emptyList());
    expectedException.expect(AlarmCallbackException.class);
    expectedException.expectMessage("Expected successful HTTP response [2xx] but got [500].");
    alarmCallback.call(stream, checkResult);
    final RecordedRequest request = server.takeRequest();
    assertThat(request.getPath()).isEqualTo("/");
    assertThat(request.getHeader("Content-Type")).isEqualTo("application/json");
    assertThat(request.getBodySize()).isPositive();
}