Util to simplify execution of basic pivot search

[patrickmann]

What?

Create a utility service that simplifies execution of basic pivot searches in the backend. It would accept the variable parts of the search (query, pivot field name) and handle the details of building the search, extracting the values from the result rows, and handling errors.

Why?

• When coding a search for the first time, it is difficult to know which classes to use and how
• There are multiple instances of these searches in the code base. They are very similar to each other: EventDefinitionAggregator InputDiagnosticService EventAssetRiskAggregator

Your Environment

• Graylog Version: 6.2

[bhuvnsh]

Hi, I'd like to take this issue as my first contribution. Let me know if it's available. Thanks!

[prokhin]

took on the job

[prokhin]

✅ Implemented PivotSearchService to encapsulate basic pivot search logic. ✅ Refactored InputDiagnosticService to use this new service. ✅ Added unit tests to verify both the new service and refactored logic.

This should simplify pivot-based queries and promote reuse across components like EventDefinitionAggregator and EventAssetRiskAggregator.

[prokhin]

@patrickmann How about it?

[patrickmann]

@prokhin Thanks for the submission. I will try and get around to reviewing it as soon as possible.

[patrickmann]

@prokhin

• new classes are missing the license header comment. Please add that - just copy from some other class.
• can you also refactor the other classes (EventDefinitionAggregator, EventAssetRiskAggregator) to use your new service?

[prokhin]

Thank you for your valuable feedback. I've taken it into work. @patrickmann I can't find these classes(EventDefinitionAggregator, EventAssetRiskAggregator). Can I know the exact name and path?