New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quick Values improvements #4082

Closed
lennartkoopmann opened this Issue Aug 14, 2017 · 1 comment

Comments

Projects
None yet
4 participants
@lennartkoopmann
Member

lennartkoopmann commented Aug 14, 2017

  • Allow to sort on value, percentage or count
  • Allow to build a chart of the values over time. This is important to see how values changed over time. This needs a "Only chart top 10[/30/100] values" to avoid huge charts with too many lines.
  • Stacking of data based on another field. For example, you could run a quick values analysis on
    a source address field and then select to stack a source address against a destination address. This would then give you the top destination addresses the specific source IP has been talking to. You
    could also run this without selecting a source IP first and get all conversation pairs, together with their count.

Open Tasks

  • Disable stacked field form if Elasticsearch is < 5.x
  • Split stacked terms result into key value pairs to fix #4216
    • Use WORD SEPARATOR MIDDLE DOT unicode character to join and split the stacked fields (but also make the character configurable)
@edmundoa

This comment has been minimized.

Member

edmundoa commented Oct 5, 2017

Points 1 and 3 are implemented in #4205

bernd added a commit that referenced this issue Oct 25, 2017

@wafflebot wafflebot bot added the in progress label Oct 25, 2017

@joschi joschi closed this in #4287 Oct 25, 2017

joschi added a commit that referenced this issue Oct 25, 2017

@wafflebot wafflebot bot removed the in progress label Oct 25, 2017

joschi added a commit that referenced this issue Oct 25, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment