Our company recently upgraded to the newest graylog version. The most important feature for us was the “Quick Values” widget. Based on documentation, this has been replaced by the field action “Aggregate”. Unfortunately, this option is missing for us and we have to work around using the Aggregation feature, which is quite annoying if you need multiple specific fields. Do we need to activate a specific configuration? Or do we need to install a plugin? Thanks in advance :slight_smile:

please check the community. It is full with same topic. Please use search.

please check the community. It is full with same topic. Please use search. I actually did. There are many many topics about the old quick values and how to replicate them. Suggestions there are the aggregate option on a specific field creating a custom aggregate Still, I did not find a thread about the option not being there. That’s why I am asking for advise about some configuration we are missing… If I am not capable of searching for the correct terms, it would be kind to point me to the right topic :slight_smile:

[image] Rollback 3.2->3.1? Graylog Central (peer support) Whether simple rollback from 3.2 to 3.1 (using package manager) is possible without data loss? In my case it’s mostly about usability, not about some technical issues. In 3.1 I could get required info in 2 clicks, now it requires much more efforts Rollback

A rollback would only be sufficient to get the “Quick Values” default widget back. Which is what we don’t want. We are willing to use the new functionality which is intended to be replacing the quick values. More precisely, the one named “Aggregate” located under field actions: https://docs.graylog.org/en/3.2/pages/searching/widgets.html#field-actions In our current setup, this option is not there for whatever reason and we want to enable it if possible - or want to understand why it is not there at least.

Aggregate got renamed to “show top values” in a recent update. Is that also not showing for you?

Thats an important information :slight_smile: yes it is, but for some reason it is greyed out. Do we need to configure extractors or something to use that function?

if the field is grey it means that this function is not possible on the field you want to run that on. I guess you have tried this on the field message?

No, I tried that on a static field we added to our logs to filter based on our application. And as far as I can tell, all our added static fields are not working for this option. Fields like e.g. source are working. Is there a way to configure fields to work with the ‘Show top values’ option?

[3.2.4] Aggregate by field missing

Graylog Central (peer support)

zoulja (Zoulja) March 30, 2020, 11:02am 4

Rollback

Topic		Replies	Views
3.2 Quick Values? Graylog Central (peer support)	15	4415	February 12, 2020
Rollback 3.2->3.1? Graylog Central (peer support)	49	4560	March 16, 2020
Feature "show top values" since Vers 3.2.3 versus "quick values" pre Vers 3.2 Graylog Central (peer support)	3	1544	April 3, 2020
Aggregation Pie Chart, row number of values, show others when more than number Graylog Central (peer support)	14	2423	December 14, 2021
Release of Quick Values Plus Widget v2.0.0 - Compatible with Graylog 2.2.1 Graylog Add-ons	1	1767	April 23, 2017

[3.2.4] Aggregate by field missing

Related topics