Graylog2 / Graylog2/graylog2-server

New Alerting lets user select fields with fielddata disabled

Open
#7,510 2 comments 0 reactions 0 assignees View on GitHub
alerting bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
The user should not have the possibility to select the field `message` or other fields from type text with fieldata disabled. Since that will only raise a query exception and will prevent the event definition from working.

## Current Behavior
A user can select `message` as a field for aggregation (group by or metric) and the event definition
is doomed to fail, since it will only throw an exeception.

This can lead to 1000s of log messages in elastic search and graylog.

## Steps to Reproduce (for bugs)
1. Create a event definition
2. select `message` field in a aggregation (card `message`)
3. Take a look into your server.log for errors like:
```
2020-02-20 14:08:16,278 ERROR: org.graylog.events.processor.aggregation.PivotAggregationSearch - Aggregation search query returned an error: Unable to perform search query:

Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.
ElasticsearchException{message=Unable to perform search query:

Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead., errorDetails=[Fielddata is disabled on text fields by default. Set fielddata=true on [message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.]}
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.checkForFailedShards(ElasticsearchBackend.java:326)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:285)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:82)
at org.graylog.plugins.views.search.engine.QueryBackend.run(QueryBackend.java:86)
at org.graylog.plugins.views.search.engine.QueryEngine.prepareAndRun(QueryEngine.java:155)
at org.graylog.plugins.views.search.engine.QueryEngine.lambda$execute$6(QueryEngine.java:95)
at java.util.concurrent.CompletableFuture$AsyncSupply.run$$$capture(CompletableFuture.java:1604)
at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
```

## Context
[z#843142]

## Your Environment
* Graylog Version: 3.2.0

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.