Graylog2 / Graylog2/graylog2-server

Dashboards show erroneous `Unknown field` warning despite field being valid.

Open
#26,753 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

When executing a query via a Graylog Dashboard, graylog appears to send an XHR req to `POST /api/views/fields`. If the dashboard search does NOT specify a time range override, the above POST req is executed with a default time range of 300s (5m) `{"timerange":{"from":300,"type":"relative"}}`.

When an explicit time range override is used, the warning is no longer present.

https://github.com/user-attachments/assets/d6b088d0-51a7-4725-af6b-4a27236bd00b

## Expected Behavior

Graylog does not show erroneous `Unknown field` warnings

## Current Behavior

Graylog shows erroneous `Unknown field` warnings

## Possible Solution

Have the XHR req for `POST /api/views/fields` take into account the configured time range of widgets.

## Steps to Reproduce (for bugs)

1.
2.
3.
4.

## Context

When using graylog to review logs i noticed this.

## Your Environment

* Graylog Version: 7.1.6

## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?

Contributor guide

Open the contributing guide

Research direction

Start at the dashboard request for POST /api/views/fields and compare the default 300-second timerange with the widget's configured override. Reproduce the warning with no explicit time range, then repeat with an override; done means valid fields no longer show erroneous Unknown field warnings in the first case.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.