I’m struggling with a use case involving repeated fields in UDM and was wondering if anyone has found a viable workaround or if this should be flagged as a bug/feature gap.
The Use Case
I want to create a UDM Dashboard with a pie chart showing the distribution of values for a specific label key (e.g., source_name).
The Data Structure
My ingested events contain multiple entries in the metadata.source_labels array. For example:
-
key: "source_name",value: "Kaspersky" -
key: "source_score",value: "100" -
key: "source_name",value: "Symantec" -
key: "source_score",value: "200" -
... (and 10 other unrelated labels)
The Problem
When I try to write the query for the dashboard, I encounter two main issues:
-
Over Counting: If I use
graph.metadata.source_labels.key = "source_name"in event section and thencount(graph.metadata.source_labels.value)in the outcome section, the system flattens the entire array. Instead of counting "Kaspersky" and "Symantec", it returns a count of 12 because it counts every value present in the labels array for that event. -
Indexing Limitation: If I try to access the key directly using
graph.metadata.source_labels["source_name"]syntax, it only retrieves the first instance of that key. In the example above, it sees "Kaspersky" but completely ignores "Symantec," leading to inaccurate data in my pie chart.
Questions
-
Is there a way in UDM Search or Dashboards to filter repeated keys so the count only applies to values where the key matches a specific string?
-
Has anyone successfully used a
anylogic in Dashboard queries to handle multiple instances of the same key within one event?
This is a frequent requirement for threat intel and multi source telemetry. If this isn't currently possible, I’d like to understand if this is a known limitation or if a bug should be raised.
Thanks in advance!
