Graylog2 / Graylog2/graylog2-server
Disable logging of event def templated field property not found
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
Events are generated without triggering an error log, even if required templated properties are not found in the source event.
## Current Behavior
When an event is generated based on an event definition having a custom field (or fields) added and the field setting has the setting "Require all template values to be set" checked, and the source event does not contain that field an error log is generated in the Graylog server log:
`ERROR [TemplateFieldValueProvider] No value found for variable "..." in template "${...}"`
## Possible Solution
## Steps to Reproduce (for bugs)
1.
2.
3.
4.
## Context
This prevents us from being "optimistic" about defining custom fields to add from the source data but it would be highly preferable to add fields that may exist, instead of the ones guaranteed to exist, in order to provide as much detail in generated events as possible. Not checking e "Require all template values ..." option (which is an unclear description of the functionality) will prevent this, but the result is that the generated event contains a list of empty fields where the source fields did not exist in the original message.
## Your Environment
* Graylog Version:
* Java Version:
* OpenSearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?
Contributor guide
Assessment
This issue has not been assessed yet.