Graylog2 / Graylog2/graylog2-server
Streams and Indices used for results
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
When running a search query either with a stream or streams selected, or without. Provide a quick way to identify all the streams and indices that contained matching results. Perhaps via predefined aggregation or exposing the stream and index name as a field for aggregating on.
After running a query, click Create | Stream/Index Results (predefined aggregation). and then being able to click into it to identify the documents for that value. Similar to how it's currently working.
## Why?
Sometimes messages leak into other streams/indices or get duplicated into other streams/indices and it would be nice to be able to quickly identify those messages for troubleshooting, or configuration validation. Also leveraging the friendly stream/index name would be preferred.
If a message from one stream leaks into another stream that is storing data in a different index, the data is stored twice and depending on the volume of data and how quickly it's caught, can lead to a significant increase in ingest and processing required.
Sometimes when I search, I do not select a stream. but when the results are returned, I want to quickly identify which streams are associated with those results. Perhaps I missed a stream when I assigned access to someone. Perhaps I noticed that the message has been duplicated into another stream and want to see if there are more streams that could have that message. Perhaps a misconfiguration on the stream or input.
## Your Environment
* Graylog Version: 4.2.5
* Elasticsearch Version: 6.8.13
* MongoDB Version: 4.4
* Operating System: Centos 7
* Browser version: Edge Chromium/Firefox
Contributor guide
Assessment
This issue has not been assessed yet.