Graylog2 / Graylog2/graylog2-server

Event Definitions using "Filter has results" option of "Filter & Aggegation" Condition Type should not have an option to change "Message Backlog".

Open
#12,316 0 comments 0 reactions 0 assignees View on GitHub
alerting improvement test-day triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
When one creates a new Event Definition, in Step 2 ("Filter & Aggregation") chooses "Filter & Aggegation" Condition Type and selects "Filter has results" option under "Create Events for Definition if...", as shown in this screenshot :
![Screenshot 2022-03-18 at 14-57-43 Graylog - Edit Very long login time Event Definition](https://user-images.githubusercontent.com/100699120/159016597-761d1f07-7c8b-4410-8694-6862e64dc684.png)

Then in Step 4 ("Notifications") "Message Backlog" part of the interface should not be visible, as backlog will have only 1 message in this case, anyway.
![Screenshot 2022-03-18 at 14-59-51 Graylog - Edit Very long login time Event Definition](https://user-images.githubusercontent.com/100699120/159016888-f0b692ee-471a-4b2d-b217-a811a80a399a.png)

## Current Behavior
In Step 4 ("Notifications") "Message Backlog" part of the interface seems to be present no matter what.

## Possible Solution
Probably the issue needs to be solved in the front-end, by showing part of the UI only if it has sense to change it.

## Context
Users can be fooled with the current behavior, hoping there is a way to have multiple messages in the backlog for single notification.
However, it is a case for Aggregations only.

## Your Environment

* Graylog Version: Graylog 4.3.0-beta.2+a61a34c on server (Oracle Corporation 1.8.0_322 on Linux 5.13.0-1017-aws)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.