more tests shows that it was the to_ip function lead to the problem of not to display the input and source statistic info and cannot search.
when i using a rule like:
rule "IPv6 address is well-formatted"
when
has_field("ipv6_input") &&
(
regex("^((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){7}([0-9a-fA-F]{1,4})$",to_string($message.ipv6_input)).matches == true
|| regex("^:(:[0-9a-fA-F]{1,4}){1,6}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:)(:[0-9a-fA-F]{1,4}){1,6}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){2}(:[0-9a-fA-F]{1,4}){1,5}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){3}(:[0-9a-fA-F]{1,4}){1,4}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){4}(:[0-9a-fA-F]{1,4}){1,3}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){5}(:[0-9a-fA-F]{1,4}){1,2}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){6}(:[0-9a-fA-F]{1,4})$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){1,6}:$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){6}((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^:(:[0-9a-fA-F]{1,4}){0,4}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){4}(:[0-9a-fA-F]{1,4}):((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){3}(:[0-9a-fA-F]{1,4}){1,2}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){2}(:[0-9a-fA-F]{1,4}){1,3}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:)(:[0-9a-fA-F]{1,4}){1,4}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){1,5}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
)
then
set_field("ipv6_address",to_ip($message.ipv6_address_input));
end
this problem always happen after manually rotate the index set if comments out the set_field with to_ip function the statistic and search comes again…i.e.
rule "IPv6 address is well-formatted"
when
has_field("ipv6_input") &&
(
regex("^((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){7}([0-9a-fA-F]{1,4})$",to_string($message.ipv6_input)).matches == true
|| regex("^:(:[0-9a-fA-F]{1,4}){1,6}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:)(:[0-9a-fA-F]{1,4}){1,6}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){2}(:[0-9a-fA-F]{1,4}){1,5}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){3}(:[0-9a-fA-F]{1,4}){1,4}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){4}(:[0-9a-fA-F]{1,4}){1,3}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){5}(:[0-9a-fA-F]{1,4}){1,2}$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){6}(:[0-9a-fA-F]{1,4})$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){1,6}:$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){6}((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^:(:[0-9a-fA-F]{1,4}){0,4}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){4}(:[0-9a-fA-F]{1,4}):((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){3}(:[0-9a-fA-F]{1,4}){1,2}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){2}(:[0-9a-fA-F]{1,4}){1,3}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:)(:[0-9a-fA-F]{1,4}){1,4}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
|| regex("^([0-9a-fA-F]{1,4}:){1,5}:((([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))\\.){3}(([\\d])|([1-9][\\d])|(1[\\d]{2})|(2[0-4][\\d])|(25[0-5]))$",to_string($message.ipv6_address_input)).matches == true
)
then
// set_field("ipv6_address",to_ip($message.ipv6_address_input));
end
