Graylog2 / Graylog2/graylog2-server
Aggregation event: Switching from avg() back to count() breaks saving
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Summary
When editing an event definition, switching the series from avg() (with
a field selected) back to count() (with no field) causes the
whole_number property to remain in the payload. This field is only valid
for avg() and results in a backend RequestError when saving.
This error shows in the response:
```
{
"type": "RequestError",
"message": "Unable to map property whole_number.\nKnown properties include: field, id, type",
"line": 1,
"column": 401,
"path": "config.series.[0].whole_number",
"reference_path": "org.graylog.events.processor.AutoValue_EventDefinitionDto$Builder[\"config\"]->org.graylog.events.processor.aggregation.AutoValue_AggregationEventProcessorConfig$Builder[\"series\"]->java.util.ArrayList[0]->org.graylog.plugins.views.search.searchtypes.pivot.series.AutoValue_Count$Builder[\"whole_number\"]"
}
```
Found this existing issue while testing fix for another issue: https://github.com/Graylog2/graylog2-server/pull/24221#issuecomment-3534678768
### Reproduction Steps
1. Create a new event definition
→ Select count() with no field → Save (works)
2. Edit the event definition
→ Switch to avg() and choose a field → Save (works)
3. Edit again
→ Switch back to count() with no field → Save (fails)
## Payloads
Working (initial count): `{ “type”: “count”, “id”: “count-”, “field”:
null }`
Broken (after switching from avg → count - note extraneous `whole_number`): `{ “type”: “count”, “id”:
“count-”, “field”: null, “whole_number”: false }`
## Expected
Switching series types should remove irrelevant fields (e.g.,
whole_number) before sending the payload.
## Notes
This is reproducible in multiple environments and appears to be an
existing UI bug where avg()-specific fields persist after switching
series types.
Contributor guide
Assessment
This issue has not been assessed yet.