Sigma Alert Group Metrics not working

[brazorfajeje]

Hi, I'm on SO 2.4.110
I have problem with group metrics on sigma alerts, suricata works fine but sigma seems in some way broken

I added the * after event.module, event.security_label and rule.uuid and see the data as *Missing, but in the Alerts section I have data with all the fields populated.

On Kibana I see no mapping conflicts or other errors.

Here a screenshot of the problem.

[brazorfajeje]

Here the log for the query * AND event.dataset:"sigma.alert" | groupby rule.name event.module* event.severity_label rule.uuid in Alerts screen taken from /opt/so/log/soc/sensoroni-server.log:

{"fields":{"query":"{\"aggs\":{\"bottom\":{\"terms\":{\"field\":\"rule.name.keyword\",\"order\":{\"_count\":\"asc\"},\"size\":500}},\"groupby_0|rule.name\":{\"aggs\":{\"groupby_0|rule.name|event.module\":{\"aggs\":{\"groupby_0|rule.name|event.module|event.severity_label\":{\"aggs\":{\"groupby_0|rule.name|event.module|event.severity_label|rule.uuid\":{\"terms\":{\"field\":\"rule.uuid\",\"order\":{\"_count\":\"desc\"},\"size\":500}}},\"terms\":{\"field\":\"event.severity_label.keyword\",\"order\":{\"_count\":\"desc\"},\"size\":500}}},\"terms\":{\"field\":\"event.module.keyword\",\"missing\":\"__missing__\",\"order\":{\"_count\":\"desc\"},\"size\":500}}},\"terms\":{\"field\":\"rule.name.keyword\",\"order\":{\"_count\":\"desc\"},\"size\":500}},\"timeline\":{\"date_histogram\":{\"field\":\"@timestamp\",\"fixed_interval\":\"1h\",\"min_doc_count\":1}}},\"query\":{\"bool\":{\"filter\":[],\"must\":[{\"query_string\":{\"analyze_wildcard\":true,\"default_field\":\"*\",\"query\":\"(* AND event.dataset: \\\"sigma.alert\\\") AND tags:alert AND NOT event.acknowledged:true AND NOT event.escalated:true\"}},{\"range\":{\"@timestamp\":{\"format\":\"strict_date_optional_time\",\"gte\":...","requestId":"ade00b56-1f22-4043-a26d-86ec72300dbe"},"level":"info","timestamp":"2025-02-18T08:55:47.832356486Z","message":"Searching Elasticsearch"}