Graylog2 / Graylog2/graylog2-server

Cloned event definition has `matched_at` of source event definition

Open
#18,026 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

A cloned event definition should have its `matched_at` value cleared, as it has not yet been matched.

## Current Behavior

The cloned event definition has the same `matched_at` value as the source event definition.

## Possible Solution

`.matchedAt(null)`

https://github.com/Graylog2/graylog2-server/blob/fee68766e1a826835504ac0358bf98d1b2b96387/graylog2-server/src/main/java/org/graylog/events/processor/EventDefinitionHandler.java#L104-L113

**edit:** Probably also `.updatedAt(null)` (or the current date+time).

https://github.com/Graylog2/graylog2-server/blob/8150875857954729d04c08c01aca5312cd542383/graylog2-server/src/main/java/org/graylog/events/processor/EventDefinitionDto.java#L61-L75

## Steps to Reproduce (for bugs)

1. Start at `/alerts/definitions`
1. Have an event definition that has matched something and note its "last matched" timestamp
2. Clone the aforementioned event definition and note the new event definition has the same "last matched" timestamp

## Context

The current behavior shows an inaccurate "last matched" timestamp for event definitions created via cloning, which can be detrimental when trying to identify misconfigured or unnecessary event definitions.

## Your Environment

* Graylog Version: `5.2.3`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.