Graylog2 / Graylog2/graylog2-server
Correlation alert: second event time field disabled until navigating Next/Back
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Description
In a **correlation** event definition, when you add a second event and select the **"Not occur in the next ..."** option, the time/duration input (number + unit such as seconds/minutes/hours) stays **disabled** and cannot be edited.
Clicking **Next** to advance the wizard and then **Back** reloads the form, after which the field becomes editable. This is a usable workaround but the field should be editable immediately.
## Steps to reproduce
1. Create a new Event Definition of type **Correlation**.
2. Add a first event, then add a **second** event.
3. On the second event, select **"Not occur in the next"**.
4. Try to set the time value/unit. The field is disabled.
5. Click **Next**, then **Back**. The time field is now editable.
## Expected behavior
Selecting **"Not occur in the next"** should immediately enable its time/unit input.
## Affected versions
Verified on 7.0 and 7.2
## Root cause
The time field is the `TimeUnitInput` rendered in the Enterprise correlation UI (`graylog-plugin-enterprise/enterprise/src/web/event-correlation/CorrelationRule.tsx`), passed `enabled={correlationRule.state_logic === 'not_for'}` with `hideCheckbox`.
In the shared component `graylog2-web-interface/src/components/common/TimeUnitInput.tsx`:
```jsx
const [checked, setChecked] = useState(enabled ?? defaultEnabled); // line 145, initializer only
...
const getCheckedValue = () => required || checked; // line 149
...
disabled={!getCheckedValue() || disabled} // lines 197 & 207
```
The internal `checked` state is initialized from the `enabled` prop **only on mount**. There is no `useEffect` that re-syncs `checked` when `enabled` later changes, so selecting the radio (which flips `enabled` to `true`) does not re-enable the field. Because `hideCheckbox` is set, the user also has no checkbox to toggle it manually. Navigating Next/Back remounts the component, re-running the initializer with the now-correct `enabled` value, which is why the field then works.
## Related
Same class of stale-state-on-navigation bug as #22024 (Input Setup Wizard button disabled after leaving and returning).
Contributor guide
Research direction
Start with graylog-plugin-enterprise/enterprise/src/web/event-correlation/CorrelationRule.tsx and trace the enabled prop passed to TimeUnitInput. Then inspect graylog2-web-interface/src/components/common/TimeUnitInput.tsx, especially its checked state and disabled conditions. Done means selecting "Not occur in the next" immediately enables the number and unit inputs without navigating Next and Back.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100