[Bug]: Error occurs when the query in valerter contains "stats by".

[congto]

What happened?

Hi @fxthiry

I have implemented a technique for collecting packager versions in Linux. Its log message format is as follows

root@kind91146:~# tail /var/log/package.log
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"xfsprogs","package_version":"6.6.0-1ubuntu2.1","package_arch":"amd64","message":"package detected: xfsprogs 6.6.0-1ubuntu2.1"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"xkb-data","package_version":"2.41-2ubuntu1.1","package_arch":"all","message":"package detected: xkb-data 2.41-2ubuntu1.1"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"xml-core","package_version":"0.19","package_arch":"all","message":"package detected: xml-core 0.19"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"xxd","package_version":"2:9.1.0016-1ubuntu7.14","package_arch":"amd64","message":"package detected: xxd 2:9.1.0016-1ubuntu7.14"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"xz-utils","package_version":"5.6.1+really5.4.5-1ubuntu0.2","package_arch":"amd64","message":"package detected: xz-utils 5.6.1+really5.4.5-1ubuntu0.2"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"zerofree","package_version":"1.1.1-1build5","package_arch":"amd64","message":"package detected: zerofree 1.1.1-1build5"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"zlib1g:amd64","package_version":"1:1.3.dfsg-3.1ubuntu2.1","package_arch":"amd64","message":"package detected: zlib1g:amd64 1:1.3.dfsg-3.1ubuntu2.1"}
{"package_timestamp":"2026-05-26T03:34:00Z","package_event_type":"package_inventory","package_scan_id":"20260526T033400Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"vector","package_version":"0.55.0-1","package_arch":"amd64","message":"package detected: vector 0.55.0-1"}
{"package_timestamp":"2026-05-26T03:39:30Z","package_event_type":"package_inventory","package_scan_id":"20260526T033930Z-kind91146","packaged_host":"kind91146","package_manager":"dpkg","package_name":"vector","package_version":"0.55.0-1","package_arch":"amd64","message":"package detected: vector 0.52.0-1"}

I have successfully collected data on VictoriaLogs.

The comparison query detects new versions; this is the query used for the "valerter" warning.

* | package_event_type:package_inventory | packaged_host:kind91146 package_name:vector | stats by (packaged_host, package_name) count_uniq(package_version) versions_count, uniq_values(package_version) versions | filter versions_count:>1

The query was successful when executed in the VictoriaLogs GUI.

But when I put the query into the "valerter" rule, I get an error. Could it be that "valerter" doesn't support the "stast by" function?

My rule file is as follows:

##rules.d/package.yaml
### Cảnh báo package nhay cam
package:
  query: '* | package_event_type:package_inventory | packaged_host:kind91146 | package_name:vector | stats by (packaged_host, package_name) count_uniq(package_version) versions_count, uniq_values(package_version) versions | filter versions_count:>1'
  parser:
    regex: '(?P<message>.*)'
  throttle:
    key: "{{ hostname }}"
    count: 3
    window: 5m
  notify:
    template: "template_cmd"
    destinations:
      - "email-ops"
      - "telegram-alerts"

The result is "journalctl -fu valerter"

May 26 10:55:57 vector-91-142 valerter[285889]: 2026-05-26T03:55:57.822078Z  WARN run_rule{rule_name=package vl_source=viclog_91_140}: valerter::tail: HTTP error from VictoriaLogs rule_name=package vl_source=viclog_91_140 status=400 Bad Request
May 26 10:55:57 vector-91-142 valerter[285889]: 2026-05-26T03:55:57.823477Z  WARN run_rule{rule_name=package vl_source=viclog_91_140}: valerter::tail: Connection failed, retrying rule_name=package vl_source=viclog_91_140 attempt=6 delay_secs=61

What did you expect?

The query in "valerter" supports "* | package_event_type:package_inventory | packaged_host:kind91146 | package_name:vector | stats by (packaged_host, package_name) count_uniq(package_version) versions_count, uniq_values(package_version) versions | filter versions_count:>1"

Affected component

Streaming / tail (VictoriaLogs connection)

Valerter version

v2.0

VictoriaLogs version

v.149 v1.50

Platform

Ubuntu

Relevant configuration (redact secrets!)

##rules.d/package.yaml
### Cảnh báo package nhay cam
package:
  query: '* | package_event_type:package_inventory | packaged_host:kind91146 | package_name:vector | stats by (packaged_host, package_name) count_uniq(package_version) versions_count, uniq_values(package_version) versions | filter versions_count:>1'
  parser:
    regex: '(?P<message>.*)'
  throttle:
    key: "{{ hostname }}"
    count: 3
    window: 5m
  notify:
    template: "template_cmd"
    destinations:
      - "email-ops"
      - "telegram-alerts"

Logs

May 26 10:59:05 vector-91-142 valerter[285889]: 2026-05-26T03:59:05.243174Z  WARN run_rule{rule_name=package vl_source=viclog_91_140}: valerter::tail: HTTP error from VictoriaLogs rule_name=package vl_source=viclog_91_140 status=400 Bad Request
May 26 10:59:05 vector-91-142 valerter[285889]: 2026-05-26T03:59:05.245133Z  WARN run_rule{rule_name=package vl_source=viclog_91_140}: valerter::tail: Connection failed, retrying rule_name=package vl_source=viclog_91_140 attempt=9 delay_secs=65

Steps to reproduce

1. Configure the client to log data.
2. Push logs to VictoriaLog using Vector.

Pre-checks

• I ran valerter --validate -c config.yaml and it passed