Files
openobserve/tests
aec4a083d9 fix: stack histogram based on stream fields (#11390)
This PR fixes the issue in #11353 

 ## New Env
```sh
name = "ZO_HISTOGRAM_BREAKDOWN_FIELDS",
help = "Comma-separated ordered list of stream fields used for stacked histogram breakdown. First match wins."
default = "severity,log_level,level,status"
```

## Flow Chart

```
UI histogram request (is_ui_histogram = true)
                │
                ▼
    ┌───────────────────────┐
    │  is_multi_stream_search?│
    └───────────────────────┘
         │ yes          │ no
         ▼              ▼
  breakdown_field    stream_names.first()
      = None              │
         │                ▼
         │       infra::schema::get(org, stream, type)
         │                │
         │         ┌──────┴──────┐
         │       fails          ok
         │         │              │
         │         ▼              ▼
         │   breakdown_field   detect_histogram_breakdown_field(fields)
         │       = None              │
         │                   priority scan (case-insensitive):
         │                     1. severity?  ──yes──▶  breakdown_field = severity
         │                     2. log_level? ──yes──▶  breakdown_field = log_level
         │                     3. level?     ──yes──▶  breakdown_field = level
         │                     4. status?    ──yes──▶  breakdown_field = status
         │                     5. none match ──────▶  breakdown_field = None
         │                          │
         └──────────────────────────┘
                          │
                          ▼
          convert_to_histogram_query(sql, streams, multi, breakdown_field)
                          │
             ┌────────────┴────────────┐
          None                      Some(field)
             │                          │
             ▼                          ▼
   SELECT zo_sql_key,        SELECT zo_sql_key,
          zo_sql_num                "field" AS zo_sql_breakdown,
   FROM stream                      zo_sql_num
   WHERE ...              FROM stream
   GROUP BY zo_sql_key    WHERE ...
   ORDER BY zo_sql_key    GROUP BY zo_sql_key, zo_sql_breakdown
                          ORDER BY zo_sql_key
             │                          │
             └────────────┬─────────────┘
                          │
                          ▼
                    execute search
                          │
                          ▼
         Response {
           hits: [{ zo_sql_key, zo_sql_breakdown?, zo_sql_num }]
           histogram_breakdown_field: Option<String>
         }
                          │
             ┌────────────┴────────────┐
          None                      Some(field)
             │                          │
             ▼                          ▼
   generateHistogramData()    generateHistogramData()
   flat map:                  breakdown map:
   key → count                (key, category) → count
   xData / yData              breakdownSeries per category
             │                          │
             ▼                          ▼
     convertLogData()         convertStackedLogData()
     single-series            multi-series stacked
     ECharts options          ECharts options
                              + per-category color (palette)
                              + scrollable legend
             │                          │
             ▼                          ▼
     flat bar chart          stacked bar chart
      (unchanged)            (one color per category)
```

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: bjp232004 <551527+bjp232004@users.noreply.github.com>
Co-authored-by: Loakesh Indiran <66478092+Loaki07@users.noreply.github.com>
Co-authored-by: Loakesh Indiran <rustyloaki@gmail.com>
2026-04-23 12:06:49 +00:00
..
2024-09-22 17:57:47 +08:00