Graylog2 / Graylog2/graylog2-server
Change default Visualisation Config of Bar Chart
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
The goal of the default settings for "Visualisation Config" in Graylog's Aggregation creation window should be to provide the user with the option they are most likely to want to use. The less times the user needs to interact with the interface to arrive at something that conveys meaning, the better the interface.
I would put foward that the default settings of "Visualisation Config" for the bar chart are not currently ideal.
## Proposed change
Visualization type: Bar Chart
Proposed default Visualization Config: Relative
Current: Group
Reasoning: I would bet one pound of british currency that almost all aggregations users perform have 3 things in common:
1) Timestamp as the X axis
2) Some form of count as the Y axis
3) Lots of possible values in the series assigned to Column
When you show an aggregation of a 3rd field using the currently default "Group" config, with a timestamp on the X axis, you end up with a graph that looks like this:

It is very hard to spot trends with the eye, because showing all the values within the column field on the graph means a lot of different bars and so the bars are very small, the colors are not visible and having a timestamp means the set of bars is replicated every interval, making it very difficult to establish at which timestamp each bar is actually happening. The visualisation is mostly empty space.
However, if we look at the same data using the glorious "Relative" config:

This is far more readable. There are less bars, because only one bar is required per interval, so the timestamp value of each bar is clearer. The value in the column field is conveyed by vertical space within the bar (which is otherwise dead space in a bar) rather than horizontal space by mashing loads of additional bars in. It scales well, even with 30 or 40 different values in the legend.
"Group" is only a better option in the event there no interval.
Contributor guide
Assessment
This issue has not been assessed yet.