Quick Values not working right in 3.0 beta 1

[kpointer]

When doing a search and selecting quick values on a field, duplicate entries are shown and the sorting seems to be random.

Expected Behavior

Quick Values should have the correct data.

Current Behavior

Steps to Reproduce (for bugs)

1. Do a search
2. Select a field and choose the Quick Values

Your Environment

• Graylog Version: 3.0 beta 1
• Elasticsearch Version: 5.6.14
• MongoDB Version: 3.6.9
• Operating System: Ubuntu 16.04 LTS
• Browser version: Firefox 65.0b7 / Safari 12.0.2

[jalogisch]

Could you please provide us with the following information:

• what field type did you have on the data in ES?
• does that happen always on all fields or only on that single one?
• is this reproducible at any time?

[kpointer]

what field type did you have on the data in ES?

Most are keyword, but the source field is {"type":"text","analyzer":"analyzer_keyword","fielddata":true}

does that happen always on all fields or only on that single one?

I'm seeing it with every field I try. I first saw it with my top hosts widget, which is using source. If i do a 5 minute search and try doing quickvalues on various fields, all that I try will have random duplicate entries and the majority won't be sorted correctly.

is this reproducible at any time?

So far it is.

[bernd]

I can reproduce this on my test setup.

It seems to be an UI issue because the API response from the Graylog server doesn't contain any duplicate values but the widget shows duplicate ones and the sorting is wrong.

[edmundoa]

After looking into this on Friday, I could not point to any change in the quick values widget that explains this change of behaviour. I could not reproduce the issue in a 2.5 build, but using the same widget code that we had in 2.5 in a 3.0 build (only replacing the deprecated React.createClass with createReacClass) also showed the described issue.

Trying to find the culprit of the issue I disabled JS minimization in the build process and that fixed the issue for me. As we changed the way we minimize assets on 3.0, I think we need to review our minimization options to see if they are doing something they should not do.