Graylog2 / Graylog2/graylog2-server

Discrepancy in display counts on Sources view

Open
#6,502 3 comments 0 reactions 0 assignees View on GitHub
feature good first issue triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I have noticed when ingesting backlog(older timestamped data) that the "Messages per minute" line graph and "sources" data do not line up.

The Messages per minute appear to be correct for the ingest rate, but the sources breakdown below it only show messages for each type from within the time window via timestamp. This means in the last hour if you've ingested logs from 2 days ago, the data is not represented as "sources within the last hour".

I would prefer the log sources overview to use relative time to current, not relative time to the log sources for determining sources, if that makes sense.

## Expected Behavior
Ingesting logs with a timestamp of 2 days ago within the recent hour should be represented in the sources count for the relative "1 hour" window.

## Current Behavior
The sources display only shows sources which have a message timestamp within the last hour. This means anything older than the relative time window is not displayed- even though it was actually ingested during the past hour.

## Possible Solution
Use indexed time or another method to query sources in the last hour rather than message timestamp field.

## Steps to Reproduce (for bugs)
1. Rapidly ingest older log data
2. Look at sources page.

## Your Environment
* Graylog Version: 3.1.2
* Elasticsearch Version: 6.8

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.