In Dashboards, the various column names may be long, unwieldy or otherwise not recognizable for user consumption. In order to provide a more concise and consumable column heading, is there a way to configure the value for each column’s heading? Looking at Decorators, these appear to only manipulate the data in the row and not the column heading.
Should have been more specific, when you go into Dashboards and create a new widget of “message table”, picking certain columns - those column headings are the issue. The reference is the underlying field name vs. being able to select the field and enter a “user friendly” name for the column heading.
Without knowing how you setup your environment its hard to help troubleshoot your issue or give you a direct answer.
What I think you maybe be lacking is message fields.
Perhaps to solve this you might have to create the fields needed, then use those fields for your columns on your widget.
The precursor to setting up graylog Dashboard/Graphs is creating the fields you need ahead of time.
This is normally done from the proper Input and then from there you can also create individual fields from Grok patterns, Regular expression and/or pipelines if needed. Then use those fields your environment monitoring Graphs. It may take some time.
Actually, all of the necessary fields are available. They can be selected from the “fields” picker (top left) when you edit the message box. However, when you are displaying those columns, the underlying field name is shown vs. being able to select the field and enter a “user readable” name for the column header.
Random example -
field name = “src_ip_geo_location_country_name”
Column header name: “SRC: Country Name”
Seeing the underlying field name (which also bloats the column width) - isn’t very user friendly. Instead, being able to use a shorter, but much more “user friendly” column header is desirable.
Dynamic templates will create those long fields and in that case you can correct those fields to make them sorter in elasticsearch. Or you can create a custom template. Either way elasticsearch is where that is done. Unfortunately, you cant correct those fields through he web interface. Sorry I cant be more help.
EDIT: I forgot , it might be possible to use a pipeline to rename fields if you wish to go that route.
here are some examples.
Right. Was hoping that there might be some simple way to configure the column name. I think the ability to configure a column “name” (regardless of the underlying field name) is something that would improve usability of dashboards.