[Bug]: Events without node are filtered out

[ralphm]

Bug description

As mentioned in #949, ever since the new node selectors, events without an associated node (e.g. agent and audit events) can no longer be selected. Their facet counts do show as 0 and the items are grayed out. This is caused by the nodes_ids facet always being provided, even when no node was selected.

Expected behavior

The nodes_ids field should be an empty list when no nodes have been selected.

Steps to reproduce

1. Go to the events tab.
2. Make sure no nodes have been selected.
3. Select a time frame that includes non-node events. This can be seen in the Event Type facet, which will have grayed out items with a zero count.

Screenshots

Error Logs

No response

Desktop

No response

Additional context

No response

[ralphm]

The change that was released to address this issue seems to work properly, except when there's also a Global node filter being applied. Then the list of nodes in the tab filter gets filtered, but we still send an empty list when no nodes are selected there, because we don't want to filter out events without a node. This effectively means that events with a node.id different from the nodes selected in the Global filter will still show up.

This may be a bit unexpected. If we want the global filter to apply here (see #953), we would have to allow the Elasticsearch query to include this list of nodes (filtered for this room?) OR host.id being empty.

@vkuznecovas may have an opinion on this, too.

[vkuznecovas]

@vkuznecovas may have an opinion on this, too.

I think in general it's a bit confusing to be able to filter out nodes in two places. I'm not entirely sure how to make it intuitive to users, though.

[ralphm]

Ideally we would have one filter, indeed. For some tabs, including the Events and Alerts tabs, you'd want to be able to see facet counts next to the nodes, though. Maybe we can have the global filter and tab filter synchronize. I.e. if you filter out nodes in the global node filter, it affects the tab's filters, too, and vice versa.

Note, though, that for the Events tab to work properly, you need to distinguish these cases:

• I only want to see stuff related to this list of nodes.
• I want to see stuff related to this list of nodes and all events that do not have node information.

[hugovalente-pm]

seems this issue was identified to be a BE thing, do you remember your findings @novykh ?
@netdata/cloud-be could someone take a look?

[ralphm]

I believe this has been resolved.