Graylog2 / Graylog2/graylog2-server

Support events as source for filter & aggregation event definitions

Open
#6,579 0 comments 0 reactions 0 assignees View on GitHub
alerting feature
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Description

The filter & aggregation event definitions are currently only supporting regular message streams but cannot handle event streams. There are use cases where users want to filter and especially aggregate on events that have been created by other event definitions/processors.

The problem with this is, that events have a very specific schema and custom fields are nested in the `fields` property of an event. (e.g. `fields.username`) That means queries need to be written to take the `fields` property into account. (e.g. `alert:true AND fields.username:admin`)

This needs some documentation in the frontend to make sure users understand it.

## Tasks

- [ ] Make it possible to select the event streams as source again
- [ ] Provide some assistance (documentation) on how to write search queries that look at custom fields in events (e.g. `fields.username:admin`)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.