New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Notify when aggregation search throws an exception #14967
Conversation
...g2-server/src/main/java/org/graylog/events/processor/aggregation/PivotAggregationSearch.java
Outdated
Show resolved
Hide resolved
@@ -144,9 +149,18 @@ public AggregationResult doSearch() throws EventProcessorException { | |||
}); | |||
|
|||
// If we have only EmptyParameterErrors, just return an empty Result | |||
if (! (errors.stream().filter(e -> !(e instanceof EmptyParameterError)).count() > 1)) { | |||
if (errors.stream().allMatch(e -> e instanceof EmptyParameterError)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we might consider backporting this fix by itself
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll check with triage
.addType(Notification.Type.SEARCH_ERROR) | ||
.addSeverity(Notification.Severity.NORMAL) | ||
.addTimestamp(DateTime.now(DateTimeZone.UTC)) | ||
.addKey(searchJob.getId()) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be better to use the eventdefintion id here.
Otherwise we might get a new notification for each failed attempt, which might be a lot.
.addSeverity(Notification.Severity.NORMAL) | ||
.addTimestamp(DateTime.now(DateTimeZone.UTC)) | ||
.addKey(searchJob.getId()) | ||
.addDetail("title", "Aggregation search failed") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should also add the title/id of the event definition here
* first draft * cleanup * linter fix * fix tests * review feedback * improve notification information
* first draft * cleanup * linter fix * fix tests * review feedback * improve notification information
resolves #14746
An event definition with aggregation will fail silently (with just a log message) when encountering an ES/OS error.
We now also generate a notification to alert the admin that events are getting lost.