Graylog 4.0 bug with fields and aggregation

Thank you for the addintional information. I understand the issue now.
My appologies, I assumed it was from this section that you were talking about.

I’m not to familiar with Event fields section. I just never had to use it yet.

How ever I did find These , maybe something in there might help.

As for creating custum fields you probably can do this on the INPUT by creating a GROK or Regular expression. Then use those fields to filter out what you need. I’m sorry I cant be more help.