zotac/graylog-deploy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix the same update-gap bug in step_alerts() - alerts weren't updating either

Browse source 
Same class of bug just fixed in step_pipeline_rules()/step_pipelines():
title-only existence check meant an alert's config (query, threshold,
group_by) could never actually change on a re-run once created. Confirmed
live: alert7's query was corrected in git (vendor:accel-ppp ->
vendor:accel-ppp AND event_type:*) but a subsequent re-run still reported
"already exists" with the old, buggy query untouched. Now compares by the
'config' object (not just title) and PUT-updates + re-enables the
schedule if it differs, same pattern as the other two fixes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
byrsapty 2026-07-23 16:30:43 +03:00
parent 609ac74574
commit c1361f16c9
1 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
install-graylog.sh
View file

@ -495,23 +495,36 @@ step_alerts() {
fi
log "Creating alert (event) definitions from $SCRIPT_DIR/alerts/*.json (idempotent)..."
# Same "compare content, PUT-update if changed" fix as step_pipeline_rules()/
# step_pipelines() - an alert's title never changes when its query/threshold
# does, so a plain title-exists check would silently skip the update
# forever. Confirmed live this session: alert7's query was fixed in git
# (vendor:accel-ppp -> vendor:accel-ppp AND event_type:*) but a re-run
# kept reporting "already exists" with the old, buggy query still live.
local existing_defs
existing_defs="$(gcurl GET /events/definitions)"
local f title id
local f title id body current_config desired_config
for f in "$SCRIPT_DIR"/alerts/alert*.json; do
[ -f "$f" ] || continue
title="$(python3 -c "import json;print(json.load(open('$f'))['title'])")"
id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
if [ -n "$id" ]; then
skip "alert '$title' already exists ($id)"
continue
fi
local body
body="$(sed \
-e "s/__NETWORK_STREAM_ID__/$NETWORK_STREAM_ID/" \
-e "s/__SERVERS_STREAM_ID__/$SERVERS_STREAM_ID/" \
-e "s/__DISCORD_NOTIFICATION_ID__/$notif_id/" \
"$f")"
id="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(next((e['id'] for e in d['event_definitions'] if e['title']=='$title'),''))")"
if [ -n "$id" ]; then
current_config="$(echo "$existing_defs" | python3 -c "import json,sys;d=json.load(sys.stdin);print(json.dumps(next(e['config'] for e in d['event_definitions'] if e['id']=='$id'),sort_keys=True))")"
desired_config="$(echo "$body" | python3 -c "import json,sys;print(json.dumps(json.load(sys.stdin)['config'],sort_keys=True))")"
if [ "$current_config" = "$desired_config" ]; then
skip "alert '$title' already up to date ($id)"
continue
fi
gcurl PUT "/events/definitions/$id" "$(echo "$body" | python3 -c "import json,sys;d=json.load(sys.stdin);d['id']='$id';print(json.dumps(d))")" >/dev/null
gcurl PUT "/events/definitions/$id/schedule" "" >/dev/null
ok "updated alert '$title' ($id) - config changed"
continue
fi
id="$(gcurl POST /events/definitions "{\"entity\": ${body}, \"share_request\": {\"selected_grantee_capabilities\": {}}}" \
| python3 -c "import json,sys;print(json.load(sys.stdin).get('id',''))")"
[ -n "$id" ] || die "alert '$title' failed to create"