Graylog2 / Graylog2/graylog2-server
Dashboards show erroneous `Unknown field` warning despite field being valid.
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When executing a query via a Graylog Dashboard, graylog appears to send an XHR req to `POST /api/views/fields`. If the dashboard search does NOT specify a time range override, the above POST req is executed with a default time range of 300s (5m) `{"timerange":{"from":300,"type":"relative"}}`.
When an explicit time range override is used, the warning is no longer present.
https://github.com/user-attachments/assets/d6b088d0-51a7-4725-af6b-4a27236bd00b
## Expected Behavior
Graylog does not show erroneous `Unknown field` warnings
## Current Behavior
Graylog shows erroneous `Unknown field` warnings
## Possible Solution
Have the XHR req for `POST /api/views/fields` take into account the configured time range of widgets.
## Steps to Reproduce (for bugs)
1.
2.
3.
4.
## Context
When using graylog to review logs i noticed this.
## Your Environment
* Graylog Version: 7.1.6
## Checklist
[] This issue fix need to be backported.
[] Does this issue have **security** implications?
Contributor guide
Research direction
Start at the dashboard request for POST /api/views/fields and compare the default 300-second timerange with the widget's configured override. Reproduce the warning with no explicit time range, then repeat with an override; done means valid fields no longer show erroneous Unknown field warnings in the first case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100