Error when searching in Graylog 4.3 with relative search

1. Describe your incident:
Hi all
We have a docker different images of Graylog running in two different environments. The latest was installed recently with next characteristics:
Graylog v4.3.8+8c4705e
MongoDB: 5.0
ElasticSearch: 7.10.2

In the older installation, when searching using the API with search/universal/relative and sort=asc we have a response from Graylog. The same search in the above version raised next message:
{
“type”: “ApiError”,
“message”: “Invalid sorting parameter: asc”
}

This was tested from REST API browser with the same behavior.

I’m not a native English speaker so it isn’t as perfect as I would like and, I don’t want to be rude in my first message but, for me it’s an error and I don’t know if you have it controlled.

Regards,
Javier

2. Describe your environment:

  • OS Information:

  • Package Version:

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Hello && Welcome @fcojavier

Does this look like what you see?

So removing “asc” it seams to go through. :thinking:

This is kind of odd.

@fcojavier

I was to fast to post, I came across this here
What I seen was this section.

range==1800 sort==timestamp:asc limit==10000

So in the sort section of the API Browser I placed that in there.

What I completely missed was adding the field you need to → sort by.
Example: Source, timestamp, EventID, etc…

Thanks for the answer. Now I know something else about Graylog :slight_smile: and it is already fixed.

In Graylog v4.2.5+59802bf if you make sort=asc the request return values, that’s why we get an error when upgrading to Graylog v4.3.8+8c4705e.

This is the screenshot from version v4.2.5+59802bf

Thanks a lot,
Javier

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.