Graylog2 / Graylog2/graylog2-server
Disallow selecting fields that cannot be aggregated when adding an alert aggregation
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## What?
When adding an aggregation to an alert, it appears you can select any field, even fields that will fail to aggregate. It would be useful for graylog to disallow this.
## Why?
I mistakenly ran into an aggregation error when creating an alert aggregation and I just wanted it to count the number of messages. I naively selected the message field and saved the alert.

A graylog system alert was shown for `SEARCH_ERROR: Aggregation search failed`.
It is my understand that graylog already knows what fields can or cannot be aggregated because in the message table (for example) it disallows you from doing top values on the `message` field. This could help users avoid pitfalls.
## Your Environment
* Graylog Version: 5.1.3
* OpenSearch Version: 2.8.0
* MongoDB Version: 6.0.7
* Operating System: Ubuntu Server 22.04 LTS
* Browser version: Google Chrome Version 114.0.5735.198 (Official Build) (arm64)
Let me know if there are any questions!
Contributor guide
Assessment
This issue has not been assessed yet.