I have problem with it. Maybe I don’t understand it well (or documentation is not clear…)
In my understanding :
# group_wait: # duration to wait collecting alerts before sending to this plugin, eg "30s"
It will send any “stored” alerts every 30s to the notification plugin (sending every x seconds)
# group_threshold: # if alerts exceed this, then the plugin will be sent the message. eg "10"
If we reach 10 alerts, it will send the alerts. (sending every x alerts)
But when I check my debug log, I see the http post is done after each alert !
(obviously I do a crowdsec restart after each modification)
I was hoping to group send the alerts, to bypass the too many open files issue (see other thread Too many open files on http-plugin - #2 by Foxinou35)