Graylog2 / Graylog2/graylog2-server

Add "Yesterday" and "Today" as relative time spans for search

Open
#11,525 5 comments 5 reactions 0 assignees View on GitHub
feature Medium Prio papercut
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

At present, there is no relative time span for "Yesterday" or "Today". These are a standard option in other log monitoring platforms.

## What?

For events, these would default to the root user timezone. For users, these would relate to the logging in user timezone.

Today should capture the present date, from 00:00 up to the present time.

Yesterday should captures yesterday's date, from 00:00 to 24:00.

## Why?

This is a standard feature of competitior platforms.

In my experience running a Splunk cluster for a buisness, these were the most-used relative time span for dashboards.

Without the addition of this feature, it is not possible for users to create a dashboard element that accurately measures Graylog Enterprise liscence usage, or triggers alerts off the same.

These are highly intuitive spans of time for human understandng of data.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.