From 55fce407e14533e5cdbb9ee3eea220c1e9a5ac30 Mon Sep 17 00:00:00 2001
From: Ryan Carroll <ryan.carroll@graylog.com>
Date: Mon, 17 Nov 2025 16:15:48 -0600
Subject: [PATCH] Clear removed 'Field' values from Aggregation Event
 Definition conditions (#24221)

* convert cleared field values to null so backend handles them correctly

* add cl entry and test

* Backend fix

---------

Co-authored-by: Zack King <zack.king@graylog.com>
---
 changelog/unreleased/issue-24007.toml         |  5 +++
 .../searchtypes/pivot/series/Count.java       |  7 +++-
 .../NumberRefExpression.test.tsx              | 34 +++++++++++++++++++
 .../NumberRefExpression.tsx                   |  4 ++-
 4 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 changelog/unreleased/issue-24007.toml

diff --git a/changelog/unreleased/issue-24007.toml b/changelog/unreleased/issue-24007.toml
new file mode 100644
index 0000000000..93b858f92f
--- /dev/null
+++ b/changelog/unreleased/issue-24007.toml
@@ -0,0 +1,5 @@
+type = "fixed"
+message = "Fixed issue in Aggregation event definitions where 'Field' value selections were not cleared correctly."
+
+pulls = ["24221"]
+issues = ["24007"]
diff --git a/graylog2-server/src/main/java/org/graylog/plugins/views/search/searchtypes/pivot/series/Count.java b/graylog2-server/src/main/java/org/graylog/plugins/views/search/searchtypes/pivot/series/Count.java
index c5ff2a4813..3d9ad007cf 100644
--- a/graylog2-server/src/main/java/org/graylog/plugins/views/search/searchtypes/pivot/series/Count.java
+++ b/graylog2-server/src/main/java/org/graylog/plugins/views/search/searchtypes/pivot/series/Count.java
@@ -22,6 +22,7 @@ import com.fasterxml.jackson.annotation.JsonTypeName;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
 import com.google.auto.value.AutoValue;
+import com.google.common.base.Strings;
 import org.graylog.plugins.views.search.searchtypes.pivot.SeriesSpec;
 
 import javax.annotation.Nullable;
@@ -70,9 +71,13 @@ public abstract class Count implements SeriesSpec, HasOptionalField {
         @JsonProperty
         public abstract Builder id(String id);
 
-        @JsonProperty
         public abstract Builder field(@Nullable String field);
 
+        @JsonProperty("field")
+        public Builder nonEmptyField(@Nullable String field) {
+            return field(Strings.emptyToNull(field));
+        }
+
         abstract Optional<String> id();
 
         abstract Optional<String> field();
diff --git a/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.test.tsx b/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.test.tsx
index e14abe6d1c..030b70a353 100644
--- a/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.test.tsx
+++ b/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.test.tsx
@@ -176,4 +176,38 @@ describe('NumberRefExpression', () => {
       ],
     });
   });
+
+  it('should send null when aggregation field is cleared', async () => {
+    const expression = {
+      expr: 'number-ref',
+      ref: 'avg-took_ms',
+    };
+    const initialSeries = { id: 'avg-took_ms', type: 'avg', field: 'took_ms' };
+    const definition = eventDefinition([initialSeries]);
+    const handleChange = jest.fn();
+
+    render(
+      <NumberRefExpression
+        eventDefinition={definition}
+        aggregationFunctions={aggregationFunctions}
+        expression={expression}
+        formattedFields={formattedFields}
+        onChange={handleChange}
+        renderLabel={false}
+        validation={{ errors: {} }}
+      />,
+    );
+
+    const fieldSelect = await screen.findByRole('combobox', { name: /select field/i });
+    await userEvent.click(fieldSelect);
+    await userEvent.keyboard('{Backspace}');
+
+    expect(handleChange).toHaveBeenCalledWith({
+      conditions: { expr: 'number-ref', ref: 'avg-' },
+      series: [
+        { field: 'took_ms', id: 'avg-took_ms', type: 'avg' },
+        { field: null, id: 'avg-', type: 'avg' },
+      ],
+    });
+  });
 });
diff --git a/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.tsx b/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.tsx
index f7deddb55e..f25fc259e4 100644
--- a/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.tsx
+++ b/graylog2-web-interface/src/components/event-definitions/event-definition-types/AggregationConditionExpressions/NumberRefExpression.tsx
@@ -105,7 +105,9 @@ const NumberRefExpression = ({
 
   const handleAggregationFieldChange = useCallback(
     (nextField) => {
-      handleFieldChange('field', nextField);
+      const normalizedField = nextField === '' ? null : nextField;
+
+      handleFieldChange('field', normalizedField);
     },
     [handleFieldChange],
   );