The ability to perform aggregation with more than one distinct-by field will be lost. It will always be possible to encode all the fields into a tuple and do a distinct-by on this new tuple field.
I confirm the wizard is well plugged with the built-in Graylog "Filter & Aggregation" functionality.
Import of old rules works well as the creation of new rules.
The ability to perform aggregation with more than one distinct-by field will be lost. It will always be possible to encode all the fields into a tuple and do a distinct-by on this new tuple field.