Graylog2 / Graylog2/graylog2-server

Disallow selecting fields that cannot be aggregated when adding an alert aggregation

Open
#15,963 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

When adding an aggregation to an alert, it appears you can select any field, even fields that will fail to aggregate. It would be useful for graylog to disallow this.

## Why?

I mistakenly ran into an aggregation error when creating an alert aggregation and I just wanted it to count the number of messages. I naively selected the message field and saved the alert.

![image](https://github.com/Graylog2/graylog2-server/assets/107503402/4d255435-2fe5-4b07-928b-fd453cbdf557)

A graylog system alert was shown for `SEARCH_ERROR: Aggregation search failed`.

It is my understand that graylog already knows what fields can or cannot be aggregated because in the message table (for example) it disallows you from doing top values on the `message` field. This could help users avoid pitfalls.

## Your Environment

* Graylog Version: 5.1.3
* OpenSearch Version: 2.8.0
* MongoDB Version: 6.0.7
* Operating System: Ubuntu Server 22.04 LTS
* Browser version: Google Chrome Version 114.0.5735.198 (Official Build) (arm64)

Let me know if there are any questions!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.