From c1361f16c91f0abcd3f47f30ce899c291be90c31 Mon Sep 17 00:00:00 2001
From: byrsapty <byrsapty@gmail.com>
Date: Thu, 23 Jul 2026 16:30:43 +0300
Subject: [PATCH] Fix the same update-gap bug in step_alerts() - alerts weren't
 updating either

Same class of bug just fixed in step_pipeline_rules()/step_pipelines():
title-only existence check meant an alert's config (query, threshold,
group_by) could never actually change on a re-run once created. Confirmed
live: alert7's query was corrected in git (vendor:accel-ppp ->
vendor:accel-ppp AND event_type:*) but a subsequent re-run still reported
"already exists" with the old, buggy query untouched. Now compares by the
'config' object (not just title) and PUT-updates + re-enables the
schedule if it differs, same pattern as the other two fixes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 install-graylog.sh | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/install-graylog.sh b/install-graylog.sh
index a094d85..7c996f0 100644
--- a/install-graylog.sh
+++ b/install-graylog.sh
@@ -495,23 +495,36 @@ step_alerts() {
   fi
 
   log "Creating alert (event) definitions from $SCRIPT_DIR/alerts/*.json (idempotent)..."
+  # Same "compare content, PUT-update if changed" fix as step_pipeline_rules()/
+  # step_pipelines() - an alert's title never changes when its query/threshold
+  # does, so a plain title-exists check would silently skip the update
+  # forever. Confirmed live this session: alert7's query was fixed in git
+  # (vendor:accel-ppp -> vendor:accel-ppp AND event_type:*) but a re-run
+  # kept reporting "already exists" with the old, buggy query still live.
   local existing_defs
   existing_defs="$(gcurl GET /events/definitions)"
-  local f title id
+  local f title id body current_config desired_config
   for f in "$SCRIPT_DIR"/alerts/alert*.json; do
     [ -f "$f" ] || continue
     title="$(python3 -c "import json;print(json.load(open('$f'))['title'])")"
-    id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
-    if [ -n "$id" ]; then
-      skip "alert '$title' already exists ($id)"
-      continue
-    fi
-    local body
     body="$(sed \
       -e "s/__NETWORK_STREAM_ID__/$NETWORK_STREAM_ID/" \
       -e "s/__SERVERS_STREAM_ID__/$SERVERS_STREAM_ID/" \
       -e "s/__DISCORD_NOTIFICATION_ID__/$notif_id/" \
       "$f")"
+    id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
+    if [ -n "$id" ]; then
+      current_config="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(json.dumps(next(e['config'] for e in d['event_definitions'] if e['id']=='$id'),sort_keys=True))")"
+      desired_config="$(echo "$body" | python3 -c "import json,sys;print(json.dumps(json.load(sys.stdin)['config'],sort_keys=True))")"
+      if [ "$current_config" = "$desired_config" ]; then
+        skip "alert '$title' already up to date ($id)"
+        continue
+      fi
+      gcurl PUT "/events/definitions/$id" "$(echo "$body" | python3 -c "import json,sys;d=json.load(sys.stdin);d['id']='$id';print(json.dumps(d))")" >/dev/null
+      gcurl PUT "/events/definitions/$id/schedule" "" >/dev/null
+      ok "updated alert '$title' ($id) - config changed"
+      continue
+    fi
     id="$(gcurl POST /events/definitions "{\"entity\": ${body}, \"share_request\": {\"selected_grantee_capabilities\": {}}}" \
       | python3 -c "import json,sys;print(json.load(sys.stdin).get('id',''))")"
     [ -n "$id" ] || die "alert '$title' failed to create"