Graylog2 / Graylog2/graylog2-server

Dashboards: same values in rows displayed once

Open
#8,616 2 comments 0 reactions 0 assignees View on GitHub
#M bug dashboards For discussion Low Prio to-verify
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior

I expect that in every row with same values the will be repeated and showed correctly.

I wish there would be a switch/option to change that behaviour to show each values in a own row.

## Current Behavior

The current behaviour is that fields in rows are empty when it's exists once.
See the following screenshot for details:
graylog_dashboard_bug240720

## Possible Solution

## Steps to Reproduce (for bugs)

1. Create Grok Pattern with name SSHAUTH and pattern
```
%{SYSLOGTIMESTAMP:system.auth.timestamp} %{SYSLOGHOST:system.auth.hostname} %{PROG:system.auth.program}(?:\[%{POSINT:pid}\]): %{DATA} %{DATA} %{DATA} %{DATA:system.auth.ssh.user} %{DATA} %{DATA:system.auth.ssh.ip} %{DATA} %{DATA} %{DATA}:(?:%{GREEDYDATA:system.auth.ssh.signature})
```
2. Create Pipeline with the following rule in stage 0 and connect it to your stream where auth.log is logged
```
rule "sshauth"
when
true
then
let authlog_test = grok("%{SSHAUTH}", to_string($message.message), true);
set_fields(authlog_test);
end
```
3. Create Dashboard with Data Table and add for example system.auth.ssh.user, system.auth.ssh.ip and source as rows to it.
4. Your Dashboard should look now like in the screenshot above.

## Context

I want to have a Dashboard for SSH Logins where I can see the logins from the last 5 minutes from specific servers.

## Your Environment

* Graylog Version: 3.3.2-1
* Elasticsearch Version: 6.8.10
* MongoDB Version: 4.2.8
* Server Operating System: Debian 10.4
* Client Operating System: MacOS 10.15.6
* Browser version: 78.0.2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.