Graylog2 / Graylog2/graylog2-server

Make time range of a single point valid

Open
#12,023 1 comment 0 reactions 1 assignee Claimed by @dennisoelkers View on GitHub
bug Medium Prio search to-verify triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Say I have a log entry of interest at `2022-01-01T00:00:00.005Z`. Both queries below includes that log entry
```
search?rangetype=absolute&from=2022-01-01T00:00:00.004Z&to=2022-01-01T00:00:00.005Z
search?rangetype=absolute&from=2022-01-01T00:00:00.005Z&to=2022-01-01T00:00:00.006Z
```
this would means that Graylog search is inclusive of boundary.

## Expected Behavior

Then I would expect the single point of time query to be valid:
```
search?rangetype=absolute&from=2022-01-01T00:00:00.005Z&to=2022-01-01T00:00:00.005Z
```
and give us all the log entries with timestamp being exactly `2022-01-01T00:00:00.005Z`.

## Current Behavior

Using the single point of time query will show an error that the `to` date should be after the `from` date, and no filtering is done.

## Possible Solution

Update the range check to only ensure `to <= from` instead of `to < from`. From how the query behave above, there should be minimal change to the query logic I think...

## Context

I would like to create a URL in the alert that search for all messages in a stream within 1 sec from a message of interest occurring on `2022-01-01T00:00:00.005Z`. This help to get a sense of the trail leading up to it. I've everything else I need except the to/from. Haven't been able to achieve that as JMTE doesn't seem to support date arithmetic >_<

So as a workaround, if I can quickly reach the message with the "show surrounding messages" button, I am done too.

I am able to read the permalink of the message, but there is no such button as it's only available for streams.

So finally, I am thinking of alerting a single point search, which then I can quickly see that message and click on the "show surrounding messages" button. I have everything I need via JMTE also. Alas the search failed despite it should work >_<

## Your Environment

* Graylog Version: 4.2.3

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.