Graylog2 / Graylog2/graylog2-server

Aggregation Event Definition Errors - OpenSearch interpreting `long` type field as `keyword`

Open
#23,035 0 comments 0 reactions 1 assignee Claimed by @kodjo-anipah View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

From customer issue: https://github.com/Graylog2/support/issues/276

The customer reports that two Event Definitions, which had been working for several months, are now generating error messages.

The error states that the keyword field type is illegal to aggregate using sum(). However, when checking the field type via index set configuration options and the global API Browser, the event_severity_level field is displayed as number/long, which should be aggregate-able via sum(). The customer attempted to rotate the index, but this did not resolve the issue.

## Expected Behavior

Fields of type `long` should support sum aggregation.

## Your Environment

OpenSearch 2.15.0
Graylog 6.2.4

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.