Triggering event on syslog.msg

anyone using graylog with librenms?

i have the graylog in libre working fine. i now want to trigger an event whenever %syslog.msg LIKE @running@ but nothing happens? i’ve tried appending an %syslog.timestamp >= %macros.past_5m without any luck. time is correct on the syslog message, but i think my problem is that its a graylog not a std. syslog server?

A post was merged into an existing topic: Syslog/graylog fields