Simplify pivot aggregation search in events

[todvora]

/nocl

Description

This tiny change simplifies significantly the request-response structure of the aggregation. This then avoids many possible parsing errors of the aggregations structure.

Motivation and Context

Fixes #17314

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[patrickmann]

Fixes most of the exceptions with missing fields.
But if only non-existent fields are specified as group-by, we still see exceptions in EventProcessorExecutionJob. No events are generated.
A corner case, but replay search shows correct event counts, even for this case.

2023-12-11 15:53:31,810 ERROR: org.graylog.events.processor.EventProcessorExecutionJob - Event processor <aggregation-v1/653b7e8743697269725dd634> failed to execute: Couldn't create events for: test (possibly due to non-existing grouping fields) (retry in 5000 ms)
org.graylog.events.processor.EventProcessorException: Couldn't create events for: test (possibly due to non-existing grouping fields)
at org.graylog.events.processor.aggregation.AggregationEventProcessor.eventsFromAggregationResult(AggregationEventProcessor.java:362) ~[classes/:?]
...
Caused by: java.lang.IndexOutOfBoundsException: index (1) must be less than size (1)
... at org.graylog.events.processor.aggregation.AggregationEventProcessor.eventsFromAggregationResult(AggregationEventProcessor.java:358) ~[classes/:?]

[patrickmann]

Can't handle only missing group-by fields

[todvora]

Thanks @patrickmann for the review, I'll look at this specific case as well. Adding full integration tests now, so it will be easier to verify such behavior.

[todvora]

I can reproduce the problem with all-unknown fields error in an integration test now, continue on a fix.