remove the group in raw

src/fgai/graylog_aggregate.py

@@ -81,7 +81,7 @@ class GraylogAggregateSource:
         }
         schema_variants: list[dict[str, object]] = []
         metric_keys = [key for key in ("metrics", "series") if key in properties]
-        group_keys = [key for key in ("groupings", "group_by", "groups", "fields") if key in properties]
+        group_keys = [key for key in ("groupings", "fields") if key in properties]
         if properties and metric_keys:
             for metric_key in metric_keys:
                 for metric_value in (["count()"], ["count"], [{"function": "count"}]):

src/fgai/monitor.py

@@ -382,6 +382,11 @@ def cached_status_with_error(cache_path: str, error_status: dict[str, object]) -
     cached = StatusSnapshotStore(cache_path).load("last_good")
     if not cached:
         return None
+    for row in cached.get("stream_coverage", []) if isinstance(cached.get("stream_coverage"), list) else []:
+        if isinstance(row, dict):
+            row.setdefault("raw_error", "")
+            row.setdefault("aggregate_error", "")
+            row.setdefault("error", row.get("aggregate_error") or row.get("raw_error") or "")
     cached["generated_at"] = int(time.time())
     cached["stale"] = True
     cached["stale_reason"] = "live_mcp_error"

tests/test_monitor.py

@@ -118,6 +118,7 @@ class MonitorTests(unittest.TestCase):
                 {
                     "summary": {"total": 42},
                     "capabilities": {"graylog_mcp": {"status": "connected"}},
+                    "stream_coverage": [{"stream_name": "Firewall", "aggregate_status": "error"}],
                     "cross_source_correlations": [{"entity": "10.0.0.1"}],
                 },
             )
@@ -129,6 +130,8 @@ class MonitorTests(unittest.TestCase):
             self.assertTrue(status["stale"])
             self.assertEqual(status["capabilities"]["graylog_mcp"]["status"], "error")
             self.assertTrue(status["status_cache"]["served_from_cache"])
+            self.assertEqual(status["stream_coverage"][0]["aggregate_error"], "")
+            self.assertEqual(status["stream_coverage"][0]["raw_error"], "")
 
 
 if __name__ == "__main__":