Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid "source_streams" for events created for an empty search result #6876

Closed
bernd opened this issue Nov 27, 2019 · 0 comments · Fixed by #6877
Closed

Invalid "source_streams" for events created for an empty search result #6876

bernd opened this issue Nov 27, 2019 · 0 comments · Fixed by #6877
Assignees
Labels
Milestone

Comments

@bernd
Copy link
Member

@bernd bernd commented Nov 27, 2019

Expected Behavior

Events created by aggregations should always have a non-empty source_streams field because this is used for permission checks.

Current Behavior

When users create an event definition that creates events when the aggregation doesn't return any results (e.g. create event when count() < 1), the resulting events don't have any streams set in the source_streams field.

Steps to Reproduce (for bugs)

  1. Create new event definition
  2. Configure search query that will not return a result
  3. Use condition count() < 1
  4. Wait until events are created
  5. Check that created events have an empty source_streams field

Your Environment

  • Graylog Version: 3.1.3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
1 participant
You can’t perform that action at this time.