Graylog2 / Graylog2/graylog2-server

Disable logging of event def templated field property not found

Open
#25,150 3 comments 0 reactions 0 assignees Claimed by @kingzacko1 View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

Events are generated without triggering an error log, even if required templated properties are not found in the source event.

## Current Behavior

When an event is generated based on an event definition having a custom field (or fields) added and the field setting has the setting "Require all template values to be set" checked, and the source event does not contain that field an error log is generated in the Graylog server log:

`ERROR [TemplateFieldValueProvider] No value found for variable "..." in template "${...}"`

## Possible Solution

## Steps to Reproduce (for bugs)

1.
2.
3.
4.

## Context

This prevents us from being "optimistic" about defining custom fields to add from the source data but it would be highly preferable to add fields that may exist, instead of the ones guaranteed to exist, in order to provide as much detail in generated events as possible. Not checking e "Require all template values ..." option (which is an unclear description of the functionality) will prevent this, but the result is that the generated event contains a list of empty fields where the source fields did not exist in the original message.

## Your Environment

* Graylog Version:
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.