Graylog2 / Graylog2/graylog2-server
Support events as source for filter & aggregation event definitions
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Description
The filter & aggregation event definitions are currently only supporting regular message streams but cannot handle event streams. There are use cases where users want to filter and especially aggregate on events that have been created by other event definitions/processors.
The problem with this is, that events have a very specific schema and custom fields are nested in the `fields` property of an event. (e.g. `fields.username`) That means queries need to be written to take the `fields` property into account. (e.g. `alert:true AND fields.username:admin`)
This needs some documentation in the frontend to make sure users understand it.
## Tasks
- [ ] Make it possible to select the event streams as source again
- [ ] Provide some assistance (documentation) on how to write search queries that look at custom fields in events (e.g. `fields.username:admin`)
Contributor guide
Assessment
This issue has not been assessed yet.