search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.22k stars 1.05k forks source link

Configure <index set> field types page does not load #19694

Open drewmiranda-gl opened 2 weeks ago

drewmiranda-gl commented 2 weeks ago

When opening the Configure field types page, i receive an error and the index fields never load:

image image

/api/system/indices/index_sets/types/63068dae8a735a37e8d535b7?page=1&per_page=100&sort=type&order=desc

{
    "type": "ApiError",
    "message": "Cannot read field \"value\" because \"<parameter1>\" is null"
}

This appears to have happened after increasing the number of fields on the page (note the page=100 in the URI)

Expected Behavior

Configure field types page loads without error

Current Behavior

Configure field types page does not load

Possible Solution

Steps to Reproduce (for bugs)

1. 2. 3. 4.

Context

Your Environment

Please let me know if there are any questions.

drewmiranda-gl commented 2 weeks ago

Quick bit of troubleshooting, if i load /api/system/indices/index_sets/types/63068dae8a735a37e8d535b7 and remove the sort argument, the API endpiont does load.

If i had to guess i would say its caused by some fields having type: null

For example:

{
    "field_name": "source_port",
    "type": null,
    "origin": "INDEX",
    "is_reserved": false
}

Unclear what is going on here. Will need to investigate further.

drewmiranda-gl commented 5 days ago

After learning how this feature works, i suspect this issue may, in part, be caused by my application of a Composable (via /index_template) index template which is superseding all graylog index templates because they use Legacy index templates.

I'm not sure its better to convert my existing Composable index template to a legacy template, OR to enable the feature flag composable_index_templates=on to allow graylog to use composable templates.

drewmiranda-gl commented 5 days ago

Also for what its worth, using the "Change Field Type" workflow, graylog does not understand this field (source_port) IS explicitly typed. I suspect this may be because graylog is exclusively looking at the index template it applies to each index set (which is being superseded by my composable template). I incorrectly thought graylog looked at the realtime mappings as seen via :9200/<index>/_mapping?pretty

image