From a6bbe1a25b07aa70a5cba9d745d0e75f7a53cd4d Mon Sep 17 00:00:00 2001
From: Maksym Yadlovskyi <maksym.yadlovskyi@graylog.com>
Date: Fri, 31 Oct 2025 10:46:41 +0100
Subject: [PATCH] Fix issue when running add to query action for multiple
 values from chart creates wrong query. (#24003)

---
 changelog/unreleased/issue-24002.toml         |  5 +++
 .../valueactions/AddToQueryHandler.test.ts    | 36 +++++++++++++++++++
 .../logic/valueactions/AddToQueryHandler.ts   |  6 +++-
 3 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 changelog/unreleased/issue-24002.toml

diff --git a/changelog/unreleased/issue-24002.toml b/changelog/unreleased/issue-24002.toml
new file mode 100644
index 0000000000..aa9b28e0b0
--- /dev/null
+++ b/changelog/unreleased/issue-24002.toml
@@ -0,0 +1,5 @@
+type = "f"
+message = "Fix issue when running add to query action for multiple values from chart creates wrong query."
+
+issues = ["24002"]
+pulls = ["24003"]
diff --git a/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.test.ts b/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.test.ts
index 855f07d03c..c3dc43fe04 100644
--- a/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.test.ts
+++ b/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.test.ts
@@ -24,6 +24,10 @@ import SearchExecutionState from 'views/logic/search/SearchExecutionState';
 import mockDispatch from 'views/test/mockDispatch';
 import { updateQueryString } from 'views/logic/slices/viewSlice';
 import type { RootState } from 'views/types';
+import AggregationWidget from 'views/logic/aggregationbuilder/AggregationWidget';
+import AggregationWidgetConfig from 'views/logic/aggregationbuilder/AggregationWidgetConfig';
+import { alice } from 'fixtures/users';
+import type { Message } from 'views/components/messagelist/Types';
 
 import AddToQueryHandler from './AddToQueryHandler';
 
@@ -92,6 +96,38 @@ describe('AddToQueryHandler', () => {
     expect(updateQueryString).toHaveBeenCalledWith('anotherQueryId', 'foo:23 AND bar:42');
   });
 
+  it('updates query string for multiple values from context', async () => {
+    const query = createQuery('anotherQueryId', 'foo:23');
+    const view = createViewWithQuery(query);
+    const state = { ...mockRootState, view: { view } } as RootState;
+    const dispatch = mockDispatch(state);
+
+    const widget = AggregationWidget.builder()
+      .id('widget1')
+      .config(AggregationWidgetConfig.builder().visualization('bar').build())
+      .build();
+    const contexts = {
+      view,
+      widget,
+      valuePath: [{ bar: 43 }, { baz: 44 }],
+      analysisDisabledFields: [],
+      currentUser: alice,
+      message: {} as Message,
+      isLocalNode: true,
+    };
+    await dispatch(
+      AddToQueryHandler({
+        queryId: 'anotherQueryId',
+        field: 'bar',
+        value: 42,
+        type: new FieldType('keyword', [], []),
+        contexts,
+      }),
+    );
+
+    expect(updateQueryString).toHaveBeenCalledWith('anotherQueryId', 'foo:23 AND bar:43 AND baz:44');
+  });
+
   it('appends NOT _exists_ fragment for proper field in case of missing bucket in input', async () => {
     const query = createQuery('anotherQueryId', 'foo:23');
     const view = createViewWithQuery(query);
diff --git a/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.ts b/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.ts
index 419ebc92c5..29ec6f89da 100644
--- a/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.ts
+++ b/graylog2-web-interface/src/views/logic/valueactions/AddToQueryHandler.ts
@@ -45,7 +45,11 @@ const AddToQueryHandler =
     const oldQuery = selectQueryString(queryId)(getState());
     const valuesToAdd = uniq(
       hasMultipleValueForActions(contexts)
-        ? contexts.valuePath.map(() => ({ field, value, type: fieldTypeFor(field, contexts?.fieldTypes) }))
+        ? contexts.valuePath.map((path) => {
+            const [pathField, pathValue] = Object.entries(path)[0];
+
+            return { field: pathField, value: pathValue, type: fieldTypeFor(field, contexts?.fieldTypes) };
+          })
         : [{ field, value, type }],
     );