Graylog2 / Graylog2/graylog2-server
Quick values break when applied to array field
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
Applying the "Quick Values" action to a field containing array values results in a pie chart that is showing the count and percentage of messages containing terms values for individual array values of the field in the data table, but proportions the slices of the pie chart according to their relation in the total sum (which is most probably >100% if array lengths exceed 1).
## Current Behavior
The pie chart shows overlapping slices due to them being rendered in size in proportion to 100%.
Even worse, if one of the slices is >~ 100%, it is overlaying all other slices.

## Possible Solution
Data table and pie slice sizes should be calculated differently. Data table rows should be calculated as:
- count: number of messages including this tag
- % should be calculated as "% of messages containing this tag" (which in sum can exceed 100%
This is currently correct, while the pie slices are calculated incorrectly. They are calculated as: `number of occurences of this array value / number of messages` while they should be calculated as `number of occurences of this array value / sum(number of occurences of array values)`.
## Steps to Reproduce (for bugs)
1. Generate messages with a field containing array values
2. Open Search
3. Click on "Quick Values" for the field containing array values
## Context
## Your Environment
* Graylog Version:
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.