From 1c335d951f90de4ad6718d1a55b987661500072e Mon Sep 17 00:00:00 2001 From: SBINFO Date: Thu, 15 Oct 2026 20:21:38 +0200 Subject: [PATCH] Fix empty "Message sources by name and type" Grafana panel (#920) The panel nests a terms aggregation on source_type.keyword under one on source_name.keyword, with no `missing` value on the inner aggregation. parsedmarc saves a source_name without a source_type for every source outside the reverse DNS map: get_service_from_reverse_dns_base_domain() returns {"name": base_domain, "type": None} when the base domain is not in base_reverse_dns_map.csv (parsedmarc/utils.py), and the no-PTR fallback names a source after its AS name with no type. Such a source yields a source_name bucket with no source_type sub-bucket, and Grafana's Elasticsearch data source then fails to build the table: with Grafana 13.2.4 (bundled Elasticsearch data source 12.9.2) and the reports in samples/aggregate/, the panel showed "No data" while 12 sources had no type; with `missing` set it lists all 27 name/type rows. Set `missing` to "-" on the source_type.keyword aggregation, the placeholder most of the dashboard's other tables use. Hand-edited rather than re-exported, to keep the diff to one value in this Grafana 7.4-era export. Co-authored-by: Claude Opus 5.5 --- CHANGELOG.md | 6 ++++++ dashboards/grafana/Grafana-DMARC_Reports.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 034b8687..5ef46a88 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +### Bug fixes + +- **The Grafana dashboard's "Message sources by name and type" table no longer comes up empty when a message source has a name but no type.** Whenever a source's reverse DNS base domain is not in `base_reverse_dns_map.csv`, `get_service_from_reverse_dns_base_domain()` names the source after that base domain and leaves its type `None`; a source with no PTR record whose AS domain is not in the map is likewise named after its AS name with no type. For every such source the saved aggregate record has a `source_name` but no `source_type`. The panel nests a `terms` aggregation on `source_type.keyword` under one on `source_name.keyword`, without a `missing` value, so such a source produced a `source_name` bucket with no `source_type` sub-bucket, and Grafana's Elasticsearch data source then failed to build the table from the response. With Grafana 13.2.4 (bundled Elasticsearch data source 12.9.2) and the reports in `samples/aggregate/`, 12 sources had a name but no type and the table showed "No data"; with `missing` set, it lists all 27 name/type rows. The `source_type.keyword` aggregation now sets `missing` to `-`, the placeholder most of the dashboard's other tables already use for absent values, so those sources are listed with `-` as their type. + ## 11.0.3 ### Bug fixes diff --git a/dashboards/grafana/Grafana-DMARC_Reports.json b/dashboards/grafana/Grafana-DMARC_Reports.json index 71494a20..d0881860 100644 --- a/dashboards/grafana/Grafana-DMARC_Reports.json +++ b/dashboards/grafana/Grafana-DMARC_Reports.json @@ -4579,7 +4579,7 @@ "id": "12", "settings": { "min_doc_count": "1", - "missing": null, + "missing": "-", "order": "desc", "orderBy": "1", "size": "0"