magicdude4eva / graylog-jira-alarmcallback Goto Github PK

The plugin is working perfectly fine and we get alerts to Jira, which is super fine! Thanks for this awesome integration.
One thing as we are using 2.0.3 Graylog is that we have disabled the "map-plugin" as mentioned. Now we don't get any [LAST_MESSAGE.XXXX] information into Jira. The other fields are working fine. Is there anything known that this is not working. We are having Syslog messages in Graylog which should then be alerted into Jira. Many many thanks in advance!!!

Hi Gerd,

Recently I have installed graylog-jira-alaramcallback plugin 1.0.8 version. Graylog version is 2.4. When I test it, It is creating dummy jira. But when actually alert gets triggerd, it is failing in building the Jira title.
Even though I am using the default configuration I am getting this error. Even if try some static message in "jira_title_template:" filed i am facing the same error.

This is the error message:

`2018-02-22 22:55:00,279 DEBG 'start_graylog' stdout output:
| 2018-02-22 22:55:00,278 ERROR: com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback - Error in building title: null

| 2018-02-22 22:55:00,279 DEBG 'start_graylog' stdout output:
| 2018-02-22 22:55:00,279 WARN : org.graylog2.alerts.AlertNotificationsSender - Alarm callback failed. Skipping.
| java.lang.NullPointerException: null
| at java.lang.String.replace(Unknown Source) ~[?:1.8.0_121]
| at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.buildDescription(JiraAlarmCallback.java:447) ~[?:?]
| at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.call(JiraAlarmCallback.java:131) ~[?:?]
| at org.graylog2.alerts.AlertNotificationsSender.send(AlertNotificationsSender.java:58) ~[graylog.jar:?]
| at org.graylog2.alerts.AlertScanner.handleTriggeredAlert(AlertScanner.java:45) ~[graylog.jar:?]
| at org.graylog2.alerts.AlertScanner.checkAlertCondition(AlertScanner.java:70) ~[graylog.jar:?]
| at org.graylog2.periodical.AlertScannerThread.lambda$doRun$0(AlertScannerThread.java:63) ~[graylog.jar:?]
| at java.util.ArrayList.forEach(Unknown Source) [?:1.8.0_121]
| at org.graylog2.periodical.AlertScannerThread.doRun(AlertScannerThread.java:63) [graylog.jar:?]
| at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?]
| at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:1.8.0_121]
| at java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:1.8.0_121]
| at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(Unknown Source) [?:1.8.0_121]
| at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:1.8.0_121]
| at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:1.8.0_121]
| at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:1.8.0_121]
| at java.lang.Thread.run(Unknown Source) [?:1.8.0_121]`

Any chance, that I can get some help on this.
Thanks in advance.__

Hi Gerd,
This is a future feature / enhancement consideration that could further enrich this great plugin.
Consider it at your leisure and don't feel obligated to add.

It would be useful to have a way of mapping Graylog field values to Jira field values.
A perfect example is:
Affects Version
We have a field in Graylog that captures the current version of the Application.
If there was a way to use this value to automatically populate Affects Version in Jira, it would cut down on manual ticket updates.

To keep this feature generic, perhaps add one more row to the settings page

Graylog-To-Jira-Mappings (just an example)
where we can enumerate a list of Graylog Field Name and Jira Field Name pairs (it is perfectly ok to use something similar to the graylog_md5 if the jira field is Custom Field, example: customfield_10501)

[LAST_MESSAGE:GraylogField1][JIRA:FIELD1], [LAST_MESSAGE:GraylogField2][JIRA:FIELD2], [LAST_MESSAGE:GraylogField3][JIRA:FIELD3] ...

Thanks

Hi Gerd,

Not sure if this has happened with you at all, every now and then the plugin logs a blank message, as if it had to data to work with (last message perhaps?)

All the fields logged are similar to a test ticket.
So instead of the actual field values, we get the field name variables.

Could there be a timing issue that the alert is triggered but the plugin still doesn't know about the last message, and hence logs the default values?

Thanks

Hi Gerd,

again i'm running into issues that i don't understand.

At first my current setup:

• Graylog 2.0.3-1
• Graylog-jira-alarmcallback 1.0.8
• Jira 6.4.3

When i trigger a stream using a message regex in the alarmcallback the graylog-server is complaining several times about the field graylog_md5. You can see this in the following extract of the graylog sever.log:

graylog-error.txt

When i don't use the message regex field the issue is created sucessfully. So here is the config of the alarm callback:

alarmcallback-config.txt

Can you explain this behaviour? I don't need to use the md5 field.

Another question is about my used regex. Is it possible to use Reg Ex Groups in your plugins. I need to use the first group of the reg ex result.

Please let me know if anything in unclear.

Thanks and regards,

Jan

I have the plugin set up and working quite effectively, but I'm unable to include the value from [LAST_MESSAGE.timestamp] in any of the JIRA ticket fields.

Do you know if this field is unavailable via the plugin, possibly generated by Graylog after the alarm callback is fired?

After installing the plugin to the Graylog plugins directory, the JIRA Alarm Callback does not appear as a selectable Notification type on the Alert Notification creation page after Graylog restart.

Using graylog-plugin-jira-1.0.8.jar with Graylog 2.4.3+2c41897

Hi there,

First of all thanks a lot for working on this one. It's very useful plugin.
I'm trying to set some values from parsed logs into a custom JIRA field.
Would you please provide an example how I can do that?

For instance, I would like to set an IP address into a JIRA custom field. Would you please help me with this one?

Hi Gerd,
Splitting from: issue

It looks like Field names have to be all caps. (no problem, updated my template)
So what happens when we have two fields that differ only in casing?
level and Level for example?

1. Case of message fields
   There is no reason why this can not be case sensitive. I never thought that a message could have multiple fields with the same name but different case. I can change it and be case-sensitive if you need it (then just log an issue)

Hi Gerd,

Splitting from the issue

Stream had 1 messages in the last 1 minutes with trigger condition more than 0 messages. (Current grace time: 0 minutes) is showing up as the first line in the Jira description even though I have not set up [ALERT_TRIGGERED_CONDITION]

Thanks

Hi Gerd,
This is a future feature / enhancement consideration that could further enrich this great plugin.
Consider it at your leisure and don't feel obligated to add.

It would be useful to have a mechanism to log additional comments to Jira ticket when repeat alerts are raised with the matching graylog_md5

Instead of just skipping logging a Jira ticket, if we could add a *_Comment *_to the ticket
(this would require one more setting for the COMMENT_TEMPLATE), we can capture additional relevant information.

Along with this if we could Count the number of repeats (this would require a jira custom field), we gain few additional benefits.
Occurrence Count which could play a big role for the prioritization of the Jira Issue
And also cap comment logging in case the occurrence count exceeds a predefined threshold,
Just in case a flood of alerts bogs down or unnecessarily dumps too many comments into Jira.

Thanks

Hi Gerd,

i have a question about your jira plugin for graylog.

I'm not able to get it to work in our environment. I installed the plugin as requested and i can add a callback in the alarm configuration for the streams. After the setup of the callback and when i trigger an alarm to test the callback nothing happens. Under "Triggered alerts" i only see the email callback. In the logfile of the graylog-server is also nothing to find.

Do have any explanation for this behavior? Please let me know if can help you with additional information.

We are using Graylog 2 and JIRA v6.4.3 (really incompatible?).

The graylog server logfile shows the following:

2016-06-28T14:11:49.462+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.6 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]
2016-06-28T14:17:07.450+02:00 WARN [JiraAlarmCallback] Skipped MD5-hash creation, MD5-string is empty. Check your config
2016-06-28T14:34:13.322+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.6 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]
2016-06-28T14:47:11.389+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.6 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]
2016-06-28T14:47:30.280+02:00 WARN [JiraAlarmCallback] Skipped MD5-hash creation, MD5-string is empty. Check your config
2016-06-28T14:50:00.328+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.6 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]
2016-06-28T14:55:51.430+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.7 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]
2016-06-28T15:01:04.513+02:00 INFO [CmdLineTool] Loaded plugin: JIRA integration plugin 1.0.7 [com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback]

At first I used an older version (1.0.6).

Here you can see the callbacl configuration:

Under "Triggered Alerts" one can only see the email callback:

Do you have any ideas why the ticket creation is not working?

Regards,

Jan

I have been trying out a basic configuration of this plugin and am getting the error that the plugin Failed creating a Jira issue.
The logs say:
ERROR [JiraAlarmCallback] Error creating JIRA issue=Failed to retrieve issue metadata, Cause=null

I am only providing non-optional fields and I have also checked that the user is able to create and edit issues in Jira. Furthermore, the project key and issue type already exists.
We are using Graylog 3 and Jira 8.1.0.

I have also looked into the jira-client library which is throwing this error and it seems that the error is thrown right here.

I am not sure whether this problem is located with our Jira, with graylog 3 (which I dont know is whether its supported), with my configuration or with the jira-client. I would appreciate any tips. Thank you!

Hi, Is it possible adding some text to a certain JIRA custom-field when creating a ticket from Graylog. You already have the JIRA MD5 custom field, but we would need the custom field for a static text when creating the ticket... Many thanks, really appreciate your help and best regards, Peter

JIRA task title field is not being picked up in version 1.0.4
This was working in version 1.0.3

I have ErrorCode:5000000 on [LAST_MESSAGE._uri_stem_base] in the JIRA task title Settings
But I'm getting [Alert] Graylog alert for stream: ErrorCode:5000000 in Jira Title.

I even tested it with ErrorCode:5000000 on [LAST_MESSAGE._URI_STEM_BASE]
and no go, which by the way was the JIRA task title settings I was using with 1.0.3 (before this fix

[LAST_MESSAGE._uri_stem_base] is working fine in the Message template and JIRA MD5 pattern

It would be awesome if it was possible to select a message and manually trigger a jira alarm callback.

This way one can selectively for example, create a Jira ticket from a message, without it necessarily meeting the stream alert rules.

I brought this up first with Graylog team, here
and they suggested that this would be the job of a plugin, I'm not sure if it can be part of this plugin which would have a alert component and ui component or if it needs to be totally a separate plugin.
Ideally it would share all the features / configs of graylog-jira-alarmcallback.

Any thoughts?

Hi,
Great plugin, trying to eliminate duplicates.
Our exception detail is already filtered and present on a graylog field.
The full message field does not have this detail hence can't use the default MESSAGE_REGEX
Any chance to get the md5 matching work of graylog definable field?

Thanks in advance

Hi Gerd,

Regression in v1.0.5
When component field is left blank

2016-04-20_14:59:06.72837 INFO  [JiraAlarmCallback] No existing open JIRA issue for MD5=2a1f99094b86a40e47c82099d5b9391c and filter-query='AND Status not in (Closed, Done)'
2016-04-20_14:59:07.34254 ERROR [JiraAlarmCallback] Error creating JIRA issue=Failed to create issue, Cause=400 Bad Request: {"errorMessages":[],"errors":{"components":"Component name '' is not valid"}}
2016-04-20_14:59:07.34385 WARN  [AlertScannerThread] Alarm callback <Graylog JIRA integration plugin> failed. Skipping.
2016-04-20_14:59:07.34736 org.graylog2.plugin.alarms.callbacks.AlarmCallbackException: Failed creating new issue
2016-04-20_14:59:07.34738       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.createJIRAIssue(JiraIssueClient.java:186)
2016-04-20_14:59:07.34738       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.trigger(JiraIssueClient.java:75)
2016-04-20_14:59:07.34738       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.call(JiraAlarmCallback.java:150)
2016-04-20_14:59:07.34739       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.call(JiraAlarmCallback.java:126)
2016-04-20_14:59:07.34739       at org.graylog2.periodical.AlertScannerThread.doRun(AlertScannerThread.java:113)
2016-04-20_14:59:07.34739       at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:83)
2016-04-20_14:59:07.34741       at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
2016-04-20_14:59:07.34748       at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
2016-04-20_14:59:07.34778       at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
2016-04-20_14:59:07.34808       at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
2016-04-20_14:59:07.34837       at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
2016-04-20_14:59:07.34870       at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
2016-04-20_14:59:07.34910       at java.lang.Thread.run(Thread.java:745)
2016-04-20_14:59:07.34945 Caused by: net.rcarz.jiraclient.JiraException: Failed to create issue
2016-04-20_14:59:07.34974       at net.rcarz.jiraclient.Issue$FluentCreate.executeCreate(Issue.java:116)
2016-04-20_14:59:07.35003       at net.rcarz.jiraclient.Issue$FluentCreate.execute(Issue.java:59)
2016-04-20_14:59:07.35117       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.createJIRAIssue(JiraIssueClient.java:181)
2016-04-20_14:59:07.35242       ... 12 more
2016-04-20_14:59:07.35286 Caused by: net.rcarz.jiraclient.RestException: 400 Bad Request: {"errorMessages":[],"errors":{"components":"Component name '' is not valid"}}
2016-04-20_14:59:07.35363       at net.rcarz.jiraclient.RestClient.request(RestClient.java:160)
2016-04-20_14:59:07.35400       at net.rcarz.jiraclient.RestClient.request(RestClient.java:182)
2016-04-20_14:59:07.35451       at net.rcarz.jiraclient.RestClient.request(RestClient.java:200)
2016-04-20_14:59:07.35491       at net.rcarz.jiraclient.RestClient.post(RestClient.java:290)
2016-04-20_14:59:07.35530       at net.rcarz.jiraclient.RestClient.post(RestClient.java:334)
2016-04-20_14:59:07.35567       at net.rcarz.jiraclient.Issue$FluentCreate.executeCreate(Issue.java:114)
2016-04-20_14:59:07.35648       ... 14 more

This was working ok in version 1.0.4

Thanks

Splitting from: issue

I noticed that if I leave JIRA MD5 pattern(optional) blank, then it saves as [MESSAGE_REGEX], meaning that there is no way of turning off non-duplicate test
Although this does not apply to us, other users might want to allow duplicate tickets.

Same applies to Message regex(optional) if I leave it blank it gets saved as ([a-zA-Z_.]+(?!.*Exception): .+).

Thanks

Would be nice to manully configure the states of the Jira issue which affect the plugin status if the issue is a duplicate or not (https://github.com/magicdude4eva/graylog-jira-alarmcallback/blob/master/src/main/java/com/bidorbuy/graylog/jira/callback/JiraAlarmCallback.java#L137).
When you use custom states in your Jira instance the filter which is applied in the referenced line does not match under some circumstances.
It would be generally nice to manully customize the query so you are able to do custom filtering additionally to the hash check.
(Maybe even so far customizeable that you are able to completely remove the additional check and simply use the md5)

Splitting from issue

Not a bug, but nice to have.
When a field has no value, it would be nice if it is replaced with blanks rather than show up as [LAST_MESSAGE.FIELD]

We're leaving the optional Priority field blank as our new workflow does not allow priority setting during the ticket creation.
Even though we left it blank and it's optional, the plugin is still trying to set the value and is failing to create the ticket with the following exception.

2018-06-15_15:48:14.64614 org.graylog2.plugin.alarms.callbacks.AlarmCallbackException: Failed creating new issue
2018-06-15_15:48:14.66703       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.createJIRAIssue(JiraIssueClient.java:213) ~[graylog-plugin-jira-1.0.8.jar:?]
2018-06-15_15:48:14.66725       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.trigger(JiraIssueClient.java:80) [graylog-plugin-jira-1.0.8.jar:?]
2018-06-15_15:48:14.66792       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.call(JiraAlarmCallback.java:153) [graylog-plugin-jira-1.0.8.jar:?]
2018-06-15_15:48:14.67057       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback.call(JiraAlarmCallback.java:128) [graylog-plugin-jira-1.0.8.jar:?]
2018-06-15_15:48:14.67100       at org.graylog2.rest.resources.alarmcallbacks.AlarmCallbacksResource.test(AlarmCallbacksResource.java:150) [graylog.jar:?]
2018-06-15_15:48:14.67209       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_161]
2018-06-15_15:48:14.67259       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_161]
2018-06-15_15:48:14.67371       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_161]
2018-06-15_15:48:14.67416       at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_161]
2018-06-15_15:48:14.67571       at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?]
2018-06-15_15:48:14.68066       at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?]
2018-06-15_15:48:14.68068       at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?]
2018-06-15_15:48:14.68068       at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:160) [graylog.jar:?]
2018-06-15_15:48:14.68069       at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?]
2018-06-15_15:48:14.68069       at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?]
2018-06-15_15:48:14.68070       at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?]
2018-06-15_15:48:14.68070       at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?]
2018-06-15_15:48:14.68070       at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
2018-06-15_15:48:14.68072       at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
2018-06-15_15:48:14.68072       at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
2018-06-15_15:48:14.68927       at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
2018-06-15_15:48:14.68982       at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
2018-06-15_15:48:14.69059       at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
2018-06-15_15:48:14.69790       at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
2018-06-15_15:48:14.69880       at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
2018-06-15_15:48:14.70103       at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
2018-06-15_15:48:14.70171       at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
2018-06-15_15:48:14.70304       at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
2018-06-15_15:48:14.70370       at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
2018-06-15_15:48:14.70514       at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_161]
2018-06-15_15:48:14.70570       at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_161]
2018-06-15_15:48:14.70686       at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161]
2018-06-15_15:48:14.70756 Caused by: net.rcarz.jiraclient.JiraException: Field 'priority' does not exist or read-only
2018-06-15_15:48:14.70901       at net.rcarz.jiraclient.Field.getFieldMetadata(Field.java:432) ~[?:?]
2018-06-15_15:48:14.70965       at net.rcarz.jiraclient.Field.toJson(Field.java:535) ~[?:?]
2018-06-15_15:48:14.71111       at net.rcarz.jiraclient.Issue$FluentCreate.executeCreate(Issue.java:104) ~[?:?]
2018-06-15_15:48:14.71188       at net.rcarz.jiraclient.Issue$FluentCreate.execute(Issue.java:59) ~[?:?]
2018-06-15_15:48:14.71267       at com.bidorbuy.graylog.alarmcallbacks.jira.JiraIssueClient.createJIRAIssue(JiraIssueClient.java:208) ~[?:?]
2018-06-15_15:48:14.71318       ... 31 more

On the same topic, we are planning to add a required field 'Severity' to ticket creation.
How can we set this value with the plugin, the only option we see is: JIRA/Graylog field mapping
but the value should be fixed, and not dynamically set by Graylog field.
Example: Severity: Critical

Thanks in advance.