Graylog2 / Graylog2/graylog2-server

Correlation alert: second event time field disabled until navigating Next/Back

Open Beginner friendly
#26,482 0 comments 0 reactions 0 assignees View on GitHub
bug frontend triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Description

In a **correlation** event definition, when you add a second event and select the **"Not occur in the next ..."** option, the time/duration input (number + unit such as seconds/minutes/hours) stays **disabled** and cannot be edited.

Clicking **Next** to advance the wizard and then **Back** reloads the form, after which the field becomes editable. This is a usable workaround but the field should be editable immediately.

## Steps to reproduce

1. Create a new Event Definition of type **Correlation**.
2. Add a first event, then add a **second** event.
3. On the second event, select **"Not occur in the next"**.
4. Try to set the time value/unit. The field is disabled.
5. Click **Next**, then **Back**. The time field is now editable.

## Expected behavior

Selecting **"Not occur in the next"** should immediately enable its time/unit input.

## Affected versions

Verified on 7.0 and 7.2

## Root cause

The time field is the `TimeUnitInput` rendered in the Enterprise correlation UI (`graylog-plugin-enterprise/enterprise/src/web/event-correlation/CorrelationRule.tsx`), passed `enabled={correlationRule.state_logic === 'not_for'}` with `hideCheckbox`.

In the shared component `graylog2-web-interface/src/components/common/TimeUnitInput.tsx`:

```jsx
const [checked, setChecked] = useState(enabled ?? defaultEnabled); // line 145, initializer only
...
const getCheckedValue = () => required || checked; // line 149
...
disabled={!getCheckedValue() || disabled} // lines 197 & 207
```

The internal `checked` state is initialized from the `enabled` prop **only on mount**. There is no `useEffect` that re-syncs `checked` when `enabled` later changes, so selecting the radio (which flips `enabled` to `true`) does not re-enable the field. Because `hideCheckbox` is set, the user also has no checkbox to toggle it manually. Navigating Next/Back remounts the component, re-running the initializer with the now-correct `enabled` value, which is why the field then works.

## Related

Same class of stale-state-on-navigation bug as #22024 (Input Setup Wizard button disabled after leaving and returning).

Contributor guide

Open the contributing guide

Research direction

Start with graylog-plugin-enterprise/enterprise/src/web/event-correlation/CorrelationRule.tsx and trace the enabled prop passed to TimeUnitInput. Then inspect graylog2-web-interface/src/components/common/TimeUnitInput.tsx, especially its checked state and disabled conditions. Done means selecting "Not occur in the next" immediately enables the number and unit inputs without navigating Next and Back.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.