Graylog2 / Graylog2/graylog2-server

Quick values break when applied to array field

Open
#4,843 0 comments 0 reactions 0 assignees View on GitHub
#L bug triaged web widgets
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

Applying the "Quick Values" action to a field containing array values results in a pie chart that is showing the count and percentage of messages containing terms values for individual array values of the field in the data table, but proportions the slices of the pie chart according to their relation in the total sum (which is most probably >100% if array lengths exceed 1).

## Current Behavior

The pie chart shows overlapping slices due to them being rendered in size in proportion to 100%.
Even worse, if one of the slices is >~ 100%, it is overlaying all other slices.

![24hwin](https://user-images.githubusercontent.com/41929/41416104-6f01e1c8-6fea-11e8-82ae-56da28a25a2a.JPG)

## Possible Solution

Data table and pie slice sizes should be calculated differently. Data table rows should be calculated as:

- count: number of messages including this tag
- % should be calculated as "% of messages containing this tag" (which in sum can exceed 100%

This is currently correct, while the pie slices are calculated incorrectly. They are calculated as: `number of occurences of this array value / number of messages` while they should be calculated as `number of occurences of this array value / sum(number of occurences of array values)`.

## Steps to Reproduce (for bugs)

1. Generate messages with a field containing array values
2. Open Search
3. Click on "Quick Values" for the field containing array values

## Context

## Your Environment

* Graylog Version:
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.