Graylog2 / Graylog2/graylog2-server

Event Fields Keys help text is ambiguous, should clarify that grouping only applies to correlated events

Open
#20,480 1 comment 0 reactions 1 assignee Claimed by @zeeklop View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

We've had a customer ask us about an issue where events are not being deduplicated by key when using Event fields. The event fields keys help text says that this feature does perform group bys:

image

However, this seems to only apply to correlated events.

Can this text be updated to remove the ambiguity and make it clear that the grouping only applies to the correlated event type?

## Expected Behavior

Help text is clear and unambigous.

## Current Behavior

Help text is unclear and states this feature can be used to do group by for 'filter & aggregation' events when this is not true.

## Possible Solution

Update text? Suggestion:

> Event Keys are Fields used to arrange Events into groups for. When used with condition type **Event Correlation**, a group is created for each unique Key, so Graylog will generate as many Events as unique Keys are found. To group events when using condition type 'Filter & Aggregation', use 'Create Events for Definition if...Aggregation of results reaches a threshold' and configure Group by Field(s).

## Steps to Reproduce (for bugs)

1.
2.
3.
4.

## Context

## Your Environment

* Graylog Version: 6.0, 6.1
* Java Version: Bundled
* OpenSearch Version: 2.x
* MongoDB Version: 7.x
* Operating System: Ubuntu 22.04 LTS
* Browser version: Google Chrome Version 128.0.6613.138 (Official Build) (arm64)

Please let me know if there are any questions.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.