Hi team, with latest version v0.92.1 we are not able to see log frequency chart showing data and get error

{
  "status": "error",
  "error": {
    "code": "invalid_input",
    "message": "invalid query 'A': invalid order by key 'timestamp' for order by clause #1 in query 'A'",
    "errors": [
      {
        "message": "For aggregation queries, order by can only reference group by keys, aggregation aliases/expressions, or aggregation indices. Valid keys are: 0, count(), severity_text"
      }
    ]
  }
}

This usually happens for the old URLs. How did you arrive here? Is it old tab or link?

Oh yes, it’s should from a old saved view. I manually put the query condition then it works. how can I fix the old saved view?

Is it old saved view or is tab? Can you help me clarify because old saved view should have been migrated cleanly without this issue

Ok, let me confirm with my team

Great, thanks for confirming.

Our team reported in the log quick filter it’s showing wrong filter values. You can see in cluster name it’s showing as namespace.

This is the first report of such issue. Can you inspect the network tab share the payload for attribute values requests?

/api/v3/autocomplete/attribute_values?aggregateOperator=noop&dataSource=logs&aggregateAttribute=&attributeKey=k8s.cluster.name&searchText=&filterAttributeKeyDataType=string&tagType=resource

Reponse

{
  "status": "success",
  "data": {
    "stringAttributeValues": [
      "",
      "Normal",
      "Warning"
    ],
    "numberAttributeValues": null,
    "boolAttributeValues": null
  }
}

Now it’s all showing Severity Text values…

That's really strange, can you run a curl equivalent of the above request and see what is returns?

Emm.. curl did return proper value

{
  "status": "success",
  "data": {
    "stringAttributeValues": [
      "dataCluster",
      "managementCluster",
      "prodCluster",
      "stagingCluster"
    ],
    "numberAttributeValues": null,
    "boolAttributeValues": null
  }
}

Probably, this is the first time I am hearing such issue so please check from your setup side once.

Could because CDN is not treat query parameter as part of cache key. Thanks for help.