Graylog2 / Graylog2/graylog2-server
Aggregation Event Definition Errors - OpenSearch interpreting `long` type field as `keyword`
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
From customer issue: https://github.com/Graylog2/support/issues/276
The customer reports that two Event Definitions, which had been working for several months, are now generating error messages.
The error states that the keyword field type is illegal to aggregate using sum(). However, when checking the field type via index set configuration options and the global API Browser, the event_severity_level field is displayed as number/long, which should be aggregate-able via sum(). The customer attempted to rotate the index, but this did not resolve the issue.
## Expected Behavior
Fields of type `long` should support sum aggregation.
## Your Environment
OpenSearch 2.15.0
Graylog 6.2.4
Contributor guide
Assessment
This issue has not been assessed yet.