Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Quick Values aggregation converts timestamp to long #4509

Closed
lennartkoopmann opened this issue Jan 24, 2018 · 3 comments · Fixed by #4516
Closed

Quick Values aggregation converts timestamp to long #4509

lennartkoopmann opened this issue Jan 24, 2018 · 3 comments · Fixed by #4516
Assignees
Labels
Milestone

Comments

@lennartkoopmann
Copy link
Contributor

When running a stacked quickvalues analysis, where the second field is a timestamp, the values are returned as long / UNIX timestamps and no a human readable format like ISO8601.

screenshot from 2018-01-23 19-56-22

screenshot from 2018-01-23 19-56-44

Steps to Reproduce (for bugs)

  1. Run a "Quick Values" analysis on any field
  2. Add "timestamp" as stacked field

Your Environment

  • Graylog Version: 2.4.0
  • Elasticsearch Version: 5.6.4
@lennartkoopmann lennartkoopmann added this to the 2.4.2 milestone Jan 24, 2018
@lennartkoopmann
Copy link
Contributor Author

In fact, this happens for a single quickvalues analysis on timestamp fields, too.

@edmundoa
Copy link
Contributor

@lennartkoopmann this is related to #4288, which is already fixed in master. I guess the question is to see if this is important enough to be included in 2.4.2 /cc: @bernd

@bernd
Copy link
Member

bernd commented Jan 24, 2018

@edmundoa This should go into 2.4.2, yes. 👍

@kroepke kroepke self-assigned this Jan 24, 2018
@ghost ghost added the in progress label Jan 24, 2018
bernd pushed a commit that referenced this issue Jan 24, 2018
* pass all stacked fields into QuickValuesVisualization

with that information we can properly format the timestamp even if it isn't the first field

still has issues with timezone conversions

* Pass timestamp to format directly

Stacked fields have a different object structure as regular fields, so
we can't rely on an object key being there.

* Do not convert timestamp to UTC

`DateTime` will convert the value to the user timezone, which is what we
want to display.

* include stacked fields in quick values title

use correct default prop name

* create stacked fields array on the fly if the caller doesn't give us the fields

this is the case for widgets, because the container doesn't know what to pass

Fixes #4509
@ghost ghost removed the in progress label Jan 24, 2018
bernd pushed a commit that referenced this issue Jan 24, 2018
* pass all stacked fields into QuickValuesVisualization

with that information we can properly format the timestamp even if it isn't the first field

still has issues with timezone conversions

* Pass timestamp to format directly

Stacked fields have a different object structure as regular fields, so
we can't rely on an object key being there.

* Do not convert timestamp to UTC

`DateTime` will convert the value to the user timezone, which is what we
want to display.

* include stacked fields in quick values title

use correct default prop name

* create stacked fields array on the fly if the caller doesn't give us the fields

this is the case for widgets, because the container doesn't know what to pass

Fixes #4509

(cherry picked from commit 272604a)
bernd pushed a commit that referenced this issue Jan 24, 2018
correctly convert back to UTC when timestamp comes from message list "Add to search" button 
previously only the quickvalues source was correct

Refs #4509
bernd pushed a commit that referenced this issue Jan 24, 2018
correctly convert back to UTC when timestamp comes from message list "Add to search" button
previously only the quickvalues source was correct

Refs #4509

(cherry picked from commit 9cfcf41)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants