{"action":"opened","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/10954","repository_url":"https://api.github.com/repos/elastic/kibana","labels_url":"https://api.github.com/repos/elastic/kibana/issues/10954/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/10954/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/10954/events","html_url":"https://github.com/elastic/kibana/issues/10954","id":218166329,"number":10954,"title":"Allow for Filtering the Log Context View","user":{"login":"weltenwort","id":973741,"avatar_url":"https://avatars0.githubusercontent.com/u/973741?v=3","gravatar_id":"","url":"https://api.github.com/users/weltenwort","html_url":"https://github.com/weltenwort","followers_url":"https://api.github.com/users/weltenwort/followers","following_url":"https://api.github.com/users/weltenwort/following{/other_user}","gists_url":"https://api.github.com/users/weltenwort/gists{/gist_id}","starred_url":"https://api.github.com/users/weltenwort/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weltenwort/subscriptions","organizations_url":"https://api.github.com/users/weltenwort/orgs","repos_url":"https://api.github.com/users/weltenwort/repos","events_url":"https://api.github.com/users/weltenwort/events{/privacy}","received_events_url":"https://api.github.com/users/weltenwort/received_events","type":"User","site_admin":false},"labels":[{"id":409457688,"url":"https://api.github.com/repos/elastic/kibana/labels/in%20progress","name":"in progress","color":"ededed","default":false},{"id":477020958,"url":"https://api.github.com/repos/elastic/kibana/labels/meta","name":"meta","color":"0052cc","default":false}],"state":"open","locked":false,"assignee":{"login":"weltenwort","id":973741,"avatar_url":"https://avatars0.githubusercontent.com/u/973741?v=3","gravatar_id":"","url":"https://api.github.com/users/weltenwort","html_url":"https://github.com/weltenwort","followers_url":"https://api.github.com/users/weltenwort/followers","following_url":"https://api.github.com/users/weltenwort/following{/other_user}","gists_url":"https://api.github.com/users/weltenwort/gists{/gist_id}","starred_url":"https://api.github.com/users/weltenwort/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weltenwort/subscriptions","organizations_url":"https://api.github.com/users/weltenwort/orgs","repos_url":"https://api.github.com/users/weltenwort/repos","events_url":"https://api.github.com/users/weltenwort/events{/privacy}","received_events_url":"https://api.github.com/users/weltenwort/received_events","type":"User","site_admin":false},"assignees":[{"login":"weltenwort","id":973741,"avatar_url":"https://avatars0.githubusercontent.com/u/973741?v=3","gravatar_id":"","url":"https://api.github.com/users/weltenwort","html_url":"https://github.com/weltenwort","followers_url":"https://api.github.com/users/weltenwort/followers","following_url":"https://api.github.com/users/weltenwort/following{/other_user}","gists_url":"https://api.github.com/users/weltenwort/gists{/gist_id}","starred_url":"https://api.github.com/users/weltenwort/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weltenwort/subscriptions","organizations_url":"https://api.github.com/users/weltenwort/orgs","repos_url":"https://api.github.com/users/weltenwort/repos","events_url":"https://api.github.com/users/weltenwort/events{/privacy}","received_events_url":"https://api.github.com/users/weltenwort/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-03-30T11:30:25Z","updated_at":"2017-03-30T11:30:25Z","closed_at":null,"body":"## Problem Statement\r\n\r\nCentralized logging with Elasticsearch and Kibana is particularly valuable for large amounts of log data from numerous sources. For large amounts of log entries however, the current context view loses most of its usefulness, because log entries not related to the anchor entry swamp the relevant entries in the context.\r\n\r\n## Discussion\r\n\r\nThe concept of the context view is to loosen the potentially very narrow filters used to find a particular event in the Discover view to allow for a broader inspection of the \"relevant\" events in the system immediately leading up to (or following) the event. This misleadingly suggests that the latter set of filters is a subset of the former, which might not even be the case in most circumstances. Another, maybe less misleading formulation would be that we want to provide a way for the user to tell Kibana what makes up the \"relevant context\" for the event so Kibana. So far the context view only uses adjacency in time as a criterion.\r\n\r\nTo summarize some observations about the two sets of filters:\r\n\r\n* The set of filters to find the anchor document and the set of filters defining the context might be disjunct. (See Use Case 1 as an example.)\r\n* In addition to adjacency in time, the context might be defined by more than one criterion (e.g. server + process name).\r\n* Some problems might require investigation from different angles (i.e. different definitions of \"context\").\r\n\r\n## Abstract Formulation\r\n\r\nIt should be possible to limit the entries shown in the context view to those \"relevant\" to the event the user is inspecting. This translates to the ability to apply filters to the context view that are different from the filters used to identify the original log entry.\r\n\r\n## Possible Solutions\r\n\r\n### Solution 1: Apply a subset of filter from Discover after switching\r\n\r\n#### Outline\r\n\r\n1. The user creates a set of filters and a query to identify the anchor event.\r\n2. The user clicks the UI element to switch to the context view.\r\n3. The context view is shown asking the user to select a subset of the previously applied filters to apply them to the context view.\r\n\r\n#### Discussion\r\n\r\n* **PRO**: Asking the user for a set of filters to apply is a concept already used when filtering in visualizations.\r\n* **PRO**: The context can be defined via multiple filters.\r\n* **CON**: The set of filters in Discover might not contain the filters required to establish a \"context\", either because the user used the query bar to narrow down the Discover result set or because the criteria just don't overlap.\r\n* **CON**: The context view requires retroactive setup to be \"useful\".\r\n\r\n### Solution 2: Create a filter based on a field selected by the user when switching\r\n\r\n#### Outline\r\n1. The user creates a set of filters and a query to identify the anchor event.\r\n2. The user clicks the UI element present in each field in an expanded row to switch to the context view.\r\n3. The context view is filtered by the term for that respective field.\r\n\r\n#### Discussion\r\n\r\n* **PRO**: Actions for individual fields in the expanded details of a row is a concept already established in Discover.\r\n* **PRO**: The context is immediately \"useful\".\r\n* **CON**: The context can only be defined via a single field.\r\n\r\n### Solution 3: Create a filter based on fields selected by the user after switching\r\n\r\n#### Outline\r\n1. The user creates a set of filters and a query to identify the anchor event.\r\n2. The user clicks the UI element to switch to the context view.\r\n3. The context view is unfiltered.\r\n4. The user expand one of the documents and clicks the filter icons for the fields required to establish the context.\r\n\r\n#### Discussion\r\n\r\n* **PRO**: Actions for individual fields in the expanded details of a row is a concept already established in the document table.\r\n* **PRO**: The context can be defined via multiple filters.\r\n* **CON**: The context view requires retroactive setup to be \"useful\".\r\n\r\n### Solution 4: Create a filter based on preconfigured settings\r\n\r\n#### Outline\r\n\r\n1. The user configures sets of filters for the index pattern that defined contexts.\r\n2. The user creates a set of filters and a query to identify the anchor event.\r\n3. The user clicks the UI element to switch to the context view with a specific preconfigured set of filters.\r\n4. The context view is filtered by the preconfigured set of filters.\r\n\r\n#### Discussion\r\n\r\n* **PRO**: The context can be defined via multiple filters.\r\n* **PRO**: The context is immediately \"useful\".\r\n* **CON**: The concept of sets of filters that can be preconfigured is new to Kibana and would require significant design and implementation effort.\r\n\r\n## Example Use Cases\r\n\r\n### Use Case 1: Error identification and investigation\r\n\r\n1. The user filters the discover view for all documents with log level 'error' in a given time frame.\r\n2. She identifies three lines originating from two distinct subsystems on two servers that match these criteria.\r\n3. First she would like to investigate the context for each line in regard to the subsystem it originates from.\r\n4. If the problem looks like it could be related to hard- or software problems on one of the servers, she would like to investigate the context of each line in respect to each server. (Note that neither the subsystem nor the server were part of the initial filter.)"}}
{"actor":{"display_login":"weltenwort"}}