How to edit the dashboard base/master query

[hkraal (Henk)]

A while ago I created a dashboard using a filter for http server errors, the base query which has been used for the widgets would have been status_code:[500 TO 599].

Meanwhile we added a input for Nginx error logs which sets a static field nginx_error: true. The field is properly applied to all new messages and can be search for without any problem. On the dashboard however these messages seem non-existent.

I suspected some sort of base/master query on which all the widgets can do some additional filtering. As the messages aren’t included in this base/master search in the first place they will not show up in the widgets either.

Exporting the dashboard as a content pack reveals query 09043b2b-7171-4ff7-8273-c952d3183a25 which seems to do exactly what I suspect.

Q: How on earth should I edit this query to become status_code:[500 TO 599] OR nginx_error:true without recreating my dashboard.

          "queries": [
            {
              "id": "09043b2b-7171-4ff7-8273-c952d3183a25",
              "timerange": {
                "type": "relative",
                "range": 86400
              },
              "query": {
                "type": "elasticsearch",
                "query_string": "status_code:[500 TO 599]"
              },
              "search_types": [
                {
                  "query": {
                    "type": "elasticsearch",
                    "query_string": "source:server.example.com AND (status_code:[500 TO 599] OR nginx_error:true)"
                  },

[hkraal (Henk)]

So I ended up re-creating the dashboard by lack of a better solution but I still hope someone would be able to answer how the “dashboard query” could be editted.

[cawfehman]

Not sure what version of Graylog you are using as the dashboards have been overhauled recently, so this may not be relevant, but in the latest version (currently 3.2.4), you can edit the query from the widget.

You can also just create a new widget using the create menu on the left navigation bar when you’re on the dashboard tab.

hth, perhaps someone else has more insight.