Skip to content

Changing delimiter char for field/decorator in Scripting API#25155

Open
janheise wants to merge 13 commits intomasterfrom
slices/risk_score
Open

Changing delimiter char for field/decorator in Scripting API#25155
janheise wants to merge 13 commits intomasterfrom
slices/risk_score

Conversation

@janheise
Copy link
Contributor

@janheise janheise commented Feb 27, 2026

Description

This PR changes the delimiter char from . to # in the Scripting API for field/decorator usage. . is causing problems when querying for nested fields.

Although it's breaking change, I do not think it's going to have any impact on existing customers as it's only marginally mentioned in the docs.
https://go2docs.graylog.org/current/making_sense_of_your_log_data/simple_search_scripting_api.htm

This PR also adds a convenience method that is used in Enterprise.

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Refactoring (non-breaking change)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have requested a documentation update.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.

@janheise janheise requested review from dennisoelkers, linuspahl and todvora and removed request for todvora March 3, 2026 10:01
@janheise janheise changed the title Adding slice by for risk score Changing delimiter char for field/decorator in Scripting API Mar 3, 2026
@janheise janheise marked this pull request as ready for review March 3, 2026 13:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant