All view searches executed upon change

[coffee-squirrel]

Expected Behavior

A change to a query/tab, or introducing a new tab (duplicate or +) should only initiate searches/queries required to fulfill what is being displayed within that tab.

Current Behavior

Any change initiating a view search (e.g. add or duplicate a tab, change a widget's configuration, change the search query or time range) invokes /api/views/search/ID_HERE/execute, which results in all tabs' searches being executed. When dealing with relatively large searches a trivial change can have a huge performance impact.

Steps to Reproduce (for bugs)

1. Have a Graylog environment with non-trivial amounts of data
2. Create a view with 10+ queries/tabs interacting with all (or a fair amount) of the aforementioned data in various ways.
3. Create a new query/tab within the view that has the default 5 minute search window, etc.
4. Note the time taken is significantly longer than if you had done a "legacy" search in that same 5 minute search window, since all searches required for all queries/tabs of the view are executed.

Context

We've been investigating an issue and created some view queries/tabs to easily switch between certain timeframes. I noticed the time taken continued to grow as queries/tabs were added, and eventually even a default query/tab in the view took over 30 seconds to display.

This is related to #6849.

Your Environment

• Graylog Version: 3.1.3
• Elasticsearch Version: 6.6.2
• MongoDB Version: 4.0.6
• Operating System: RHEL
• Browser version: Firefox

[tellistone]

Testing confirms this is still the case as of Graylog 4.3.9

[dennisoelkers]

Hey @coffee-squirrel,

I hope it is okay for me to reopen the issue, as we still want to work on this?

[tellistone]

IMO this should be high priority, as it will have an outsized effect on the user experience when using the multi-tab dashboards, such as those packaged with Illuminate & Security.