Graylog2 / Graylog2/graylog2-server
New Alerting lets user select fields with fielddata disabled
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
The user should not have the possibility to select the field `message` or other fields from type text with fieldata disabled. Since that will only raise a query exception and will prevent the event definition from working.
## Current Behavior
A user can select `message` as a field for aggregation (group by or metric) and the event definition
is doomed to fail, since it will only throw an exeception.
This can lead to 1000s of log messages in elastic search and graylog.
## Steps to Reproduce (for bugs)
1. Create a event definition
2. select `message` field in a aggregation (card `message`)
3. Take a look into your server.log for errors like:
```
2020-02-20 14:08:16,278 ERROR: org.graylog.events.processor.aggregation.PivotAggregationSearch - Aggregation search query returned an error: Unable to perform search query:
Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
ElasticsearchException{message=Unable to perform search query:
Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead., errorDetails=[Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.]}
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.checkForFailedShards(ElasticsearchBackend.java:326)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:285)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:82)
at org.graylog.plugins.views.search.engine.QueryBackend.run(QueryBackend.java:86)
at org.graylog.plugins.views.search.engine.QueryEngine.prepareAndRun(QueryEngine.java:155)
at org.graylog.plugins.views.search.engine.QueryEngine.lambda$execute$6(QueryEngine.java:95)
at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1604)
at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
```
## Context
[z#843142]
## Your Environment
* Graylog Version: 3.2.0
Contributor guide
Assessment
This issue has not been assessed yet.