Watchlist search filters with query parameter definitions cannot be included in content packs

[miwent]

Expected Behavior

When including event definitions with search filters using lookup-based parameters ($variable$) the content pack system should include the lookup information about the lookup. The reference(s) to the lookup should not use the lookup ID values but the name of the lookup tables to avoid forcing the inclusion of the lookup configuration in the same content pack as the event definition.

Current Behavior

Lookup table information is not included in the content pack. Installing a content pack with defined parameters results in the following:

Possible Solution

Steps to Reproduce (for bugs)

1. Create a test event definition that uses lookup-based query parameters
2. Export the newly created content pack
3. Import the content pack on a different system or remove the event definition and install the content pack
4. Edit the test event definition and review the filter parameters - the query parameter definition does not exist

Context

Cannot include event definitions with query parameters in content packs.

Your Environment

• Graylog Version: 4.1.2
• Java Version: 1.8.0_292
• Elasticsearch Version: 6.8.18
• MongoDB Version: 4.0.26
• Operating System:
• Browser version:

[bernd]

@miwent Is this a blocker for 4.2?

[miwent]

@miwent Is this a blocker for 4.2?

No, but it has to be in 4.2.1

[miwent]

I missed that there is already an open issue for this: #7003

[bernd]

@Graylog2/search Can you please talk with @miwent about this issue and if there is a way to solve it? Thank you!

[janheise]

might be solved with https://github.com/Graylog2/graylog2-server/pull/21563, needs re-testing