New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quick Values aggregation converts timestamp to long #4509

Closed
lennartkoopmann opened this Issue Jan 24, 2018 · 3 comments

Comments

Projects
None yet
4 participants
@lennartkoopmann
Member

lennartkoopmann commented Jan 24, 2018

When running a stacked quickvalues analysis, where the second field is a timestamp, the values are returned as long / UNIX timestamps and no a human readable format like ISO8601.

screenshot from 2018-01-23 19-56-22

screenshot from 2018-01-23 19-56-44

Steps to Reproduce (for bugs)

  1. Run a "Quick Values" analysis on any field
  2. Add "timestamp" as stacked field

Your Environment

  • Graylog Version: 2.4.0
  • Elasticsearch Version: 5.6.4

@lennartkoopmann lennartkoopmann added this to the 2.4.2 milestone Jan 24, 2018

@lennartkoopmann

This comment has been minimized.

Member

lennartkoopmann commented Jan 24, 2018

In fact, this happens for a single quickvalues analysis on timestamp fields, too.

@lennartkoopmann lennartkoopmann added the bug label Jan 24, 2018

@edmundoa

This comment has been minimized.

Member

edmundoa commented Jan 24, 2018

@lennartkoopmann this is related to #4288, which is already fixed in master. I guess the question is to see if this is important enough to be included in 2.4.2 /cc: @bernd

@bernd

This comment has been minimized.

Member

bernd commented Jan 24, 2018

@edmundoa This should go into 2.4.2, yes. 👍

@kroepke kroepke self-assigned this Jan 24, 2018

@wafflebot wafflebot bot added the in progress label Jan 24, 2018

@bernd bernd closed this in #4516 Jan 24, 2018

bernd added a commit that referenced this issue Jan 24, 2018

Properly handle timestamp field in stacked quickvalues (#4516)
* pass all stacked fields into QuickValuesVisualization

with that information we can properly format the timestamp even if it isn't the first field

still has issues with timezone conversions

* Pass timestamp to format directly

Stacked fields have a different object structure as regular fields, so
we can't rely on an object key being there.

* Do not convert timestamp to UTC

`DateTime` will convert the value to the user timezone, which is what we
want to display.

* include stacked fields in quick values title

use correct default prop name

* create stacked fields array on the fly if the caller doesn't give us the fields

this is the case for widgets, because the container doesn't know what to pass

Fixes #4509

@wafflebot wafflebot bot removed the in progress label Jan 24, 2018

bernd added a commit that referenced this issue Jan 24, 2018

Properly handle timestamp field in stacked quickvalues (#4516)
* pass all stacked fields into QuickValuesVisualization

with that information we can properly format the timestamp even if it isn't the first field

still has issues with timezone conversions

* Pass timestamp to format directly

Stacked fields have a different object structure as regular fields, so
we can't rely on an object key being there.

* Do not convert timestamp to UTC

`DateTime` will convert the value to the user timezone, which is what we
want to display.

* include stacked fields in quick values title

use correct default prop name

* create stacked fields array on the fly if the caller doesn't give us the fields

this is the case for widgets, because the container doesn't know what to pass

Fixes #4509

(cherry picked from commit 272604a)

bernd added a commit that referenced this issue Jan 24, 2018

Fix timezone for message list add to query in field timestamp (#4519)
correctly convert back to UTC when timestamp comes from message list "Add to search" button 
previously only the quickvalues source was correct

Refs #4509

bernd added a commit that referenced this issue Jan 24, 2018

Fix timezone for message list add to query in field timestamp (#4519)
correctly convert back to UTC when timestamp comes from message list "Add to search" button
previously only the quickvalues source was correct

Refs #4509

(cherry picked from commit 9cfcf41)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment