You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We want to remove the embedded discover and replace it with a more modern component. This will allow us to remove angular as a dependency, improve usability and performance. Also, this will allow us to adapt to the upcoming changes from the upstream OpenSearch related to the new discover, the changes of the OUI library and others.
We use discover in multiple places, the most apparent one is the Events tabs:
But its components are also used to build other visualizations, managing filters and some events. The removal of the discover will require a refactor of these uses.
Our strategy will be to create our own component based on the one we already created for the new inventory tab:
Screen.Recording.2023-10-25.at.10.52.34.mov
We will add to the current inventory tab the time filters and the timeline visualization as shown in the discover.
In general our implementation strategy will be to add the necessary changes to make the discover redundant, and then, remove it. Also, we don't want to lose functionality, if there are use cases not identified in this issue, discuss them in the comments sections below. We will update the issue body with the conclusion.
Functional requirements
As a user, I want to be able to:
Explore data:
view the events in a timeline visualization.
customize the fields displayed in the table
receive events as they are produced (auto reload)
see the whole event details in a fly-out panel
Generate reports:
manage saved queries (CRUD)
generate a report in the reporting plugin, based on a query
download a query as a CSV.
Explore event context:
click on a scripted field and follow a link to other modules
click a field and display a fly-out with a sub-query of related events
Non-functional requirements
Research the use of scripted fields to add context to values anywhere in our data tables
Implementation restrictions
Use the newly developed inventory component, adapting or increasing its features. These modifications should not break the current behaviors.
Description
We want to remove the embedded discover and replace it with a more modern component. This will allow us to remove angular as a dependency, improve usability and performance. Also, this will allow us to adapt to the upcoming changes from the upstream OpenSearch related to the new
discover
, the changes of the OUI library and others.We use discover in multiple places, the most apparent one is the Events tabs:
But its components are also used to build other visualizations, managing filters and some events. The removal of the
discover
will require a refactor of these uses.Our strategy will be to create our own component based on the one we already created for the new inventory tab:
Screen.Recording.2023-10-25.at.10.52.34.mov
We will add to the current inventory tab the time filters and the timeline visualization as shown in the
discover
.In general our implementation strategy will be to add the necessary changes to make the
discover
redundant, and then, remove it. Also, we don't want to lose functionality, if there are use cases not identified in this issue, discuss them in the comments sections below. We will update the issue body with the conclusion.Functional requirements
As a user, I want to be able to:
Explore data:
Generate reports:
Explore event context:
Non-functional requirements
Implementation restrictions
Plan
Related fixes/features
The text was updated successfully, but these errors were encountered: