Graylog2 / Graylog2/graylog2-server
Events Overview widget returns no results when an events stream is in the dashboard stream filter
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Summary
On the **Events Overview** widget, the dashboard's stream selector filters by `source_streams` (the source stream of the underlying message) rather than `streams` (the events stream the event lives on). As a result, when the dashboard's stream selector includes an events stream like **All events**, the widget returns zero results — because no event document has `source_streams` matching an events stream. Switching the selector to a source stream like **Default Stream** returns results normally.
This is specific to the Events Overview widget. When selecting the All Events stream, I thought the results would indeed display all events, but that was not the case. Is it intended that the source stream must be selected instead?
If it is intended, a UI clarification on the widget's stream selector (e.g. labeling it "Source Streams" or surfacing a hint that events streams aren't valid here) might help with clarity.
The issue can be seen here. Note that when specifying a stream, I had to pick the Default Stream instead of the All Events stream in order for my events to show up. Also note that it is also unable to obtain the events field types due to that stream no longer being selected.
## Reproduce
1. Create a new dashboard with an **Events Overview** widget (default config, no widget-level stream override).
2. In the dashboard stream selector at the top, add the **All events** stream.
3. Run the search with an empty query — the widget shows **0 results**.
4. Remove the events stream and add the **Default Stream** instead (or which ever stream your events originated from).
5. Run the search again — results appear.
## How this differs from the Alerts & Events page
| | `streams` filter (the events stream the event lives on) | `source_streams` filter (source stream of the underlying message) |
|---|---|---|
| **Alerts & Events page** | `streams IN [events streams the user has permission to read]` | applied **only when the user has restricted source-stream access** |
| **Events Overview widget** | `streams IN [hardcoded {AllEvents, SystemEvents}]` | `source_streams IN [dashboard stream selector value]` — **always applied** |
On `/alerts`, there's no UI stream selector that maps to either filter. On a dashboard, the stream selector flows into the widget's `source_streams` filter via `query.usedStreamIds()` — which is what makes the events-stream selection fail.
## Possible cause
- Widget per-search-type filter: [`OSEventList.java#L53-L62`](https://github.com/Graylog2/graylog2-server/blob/a74ffbf8f186c32072c33d06e3e05b98168629c4/graylog-storage-opensearch2/src/main/java/org/graylog/storage/opensearch2/views/searchtypes/OSEventList.java#L53-L62) — adds `must(termsQuery(source_streams, query.usedStreamIds()))`.
- Widget wrapping streams filter (already in place): [`OpenSearchBackend.java#L178-L181`](https://github.com/Graylog2/graylog2-server/blob/a74ffbf8f186c32072c33d06e3e05b98168629c4/graylog-storage-opensearch2/src/main/java/org/graylog/storage/opensearch2/views/OpenSearchBackend.java#L178-L181) — applies the `streams` filter using `EventList.effectiveStreams()`.
- Alerts & Events page filter: [`MoreSearchAdapterOS2.java#L222`](https://github.com/Graylog2/graylog2-server/blob/a74ffbf8f186c32072c33d06e3e05b98168629c4/graylog-storage-opensearch2/src/main/java/org/graylog/storage/opensearch2/MoreSearchAdapterOS2.java#L222) and [`#L245-L247`](https://github.com/Graylog2/graylog2-server/blob/a74ffbf8f186c32072c33d06e3e05b98168629c4/graylog-storage-opensearch2/src/main/java/org/graylog/storage/opensearch2/MoreSearchAdapterOS2.java#L245-L247).
Same shape in the opensearch3 backend: [`OSEventList.java`](https://github.com/Graylog2/graylog2-server/blob/a74ffbf8f186c32072c33d06e3e05b98168629c4/graylog-storage-opensearch3/src/main/java/org/graylog/storage/opensearch3/views/searchtypes/OSEventList.java).
Assisted with [Claude Code](https://claude.com/claude-code)
Contributor guide
Assessment
This issue has not been assessed yet.