Graylog2 / Graylog2/graylog2-server
Make time range of a single point valid
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Say I have a log entry of interest at `2022-01-01T00:00:00.005Z`. Both queries below includes that log entry
```
search?rangetype=absolute&from=2022-01-01T00:00:00.004Z&to=2022-01-01T00:00:00.005Z
search?rangetype=absolute&from=2022-01-01T00:00:00.005Z&to=2022-01-01T00:00:00.006Z
```
this would means that Graylog search is inclusive of boundary.
## Expected Behavior
Then I would expect the single point of time query to be valid:
```
search?rangetype=absolute&from=2022-01-01T00:00:00.005Z&to=2022-01-01T00:00:00.005Z
```
and give us all the log entries with timestamp being exactly `2022-01-01T00:00:00.005Z`.
## Current Behavior
Using the single point of time query will show an error that the `to` date should be after the `from` date, and no filtering is done.
## Possible Solution
Update the range check to only ensure `to <= from` instead of `to < from`. From how the query behave above, there should be minimal change to the query logic I think...
## Context
I would like to create a URL in the alert that search for all messages in a stream within 1 sec from a message of interest occurring on `2022-01-01T00:00:00.005Z`. This help to get a sense of the trail leading up to it. I've everything else I need except the to/from. Haven't been able to achieve that as JMTE doesn't seem to support date arithmetic >_<
So as a workaround, if I can quickly reach the message with the "show surrounding messages" button, I am done too.
I am able to read the permalink of the message, but there is no such button as it's only available for streams.
So finally, I am thinking of alerting a single point search, which then I can quickly see that message and click on the "show surrounding messages" button. I have everything I need via JMTE also. Alas the search failed despite it should work >_<
## Your Environment
* Graylog Version: 4.2.3
Contributor guide
Assessment
This issue has not been assessed yet.