Graylog2 / Graylog2/graylog2-server
Missing backlog when there is an emtpy value in aggregation
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When an alert, that has an aggregation on a field, has one of the fields with no value (Empty Value), the resulting notification will have no backlog attached.
## Expected Behavior
Backlog should always happen as configured, even if one of the aggregated fields has no occurences and generates an "Empty Value".
## Current Behavior
As far as my experience, whenever there is an "Empty Value" in an aggregated field, the notification will have a "no backlog" message instead of the log.
When all aggregated fields are defined, the backlog is included.
## Possible Solution
I don't know what's happening internally, but shouldn't be hard to fix.
## Steps to Reproduce (for bugs)
I can provide a full example if you cannot reproduce it. Sorry.
## Context
We were trying to make notifications as rich as possible, that is with many fields.
We don't even need aggregation, but GL requires that all fields in the notification have to be aggregated first.
We also like to always include one line of backlog in notifications.
## Your Environment
A small cluster of Graylog.
* Graylog Version: Graylog 5.0.5+d61a926
* Java Version: Eclipse Adoptium 17.0.6
* Elasticsearch Version: OpenSearch 2.0.1
* MongoDB Version: 6.0.4
* Operating System: Ubuntu 22.04 LTS
* Browser version: Chrome
Contributor guide
Assessment
This issue has not been assessed yet.