Hi,
I understand. My use case, it is true, may not be the most common, but I thought of probing the ground since I am it seems not alone in it, and that maybe I could prove the point of the improvement I am suggesting. In the end, all I would like to see is for a feature that is already present (overriding time and the filter query) to be accessible from the dashboard URL, which is done on a similar feature (searches) using what seems not-so-different machinery onder the hood. The TL;DR ends here!
In the interest of constructive criticism, and if anyone from Graylog takes a look at this post, I would say that the views/searches/dashboard UX come off as a bit unfocused. It looks like to me that maybe Graylog 4 marked a big shift in those concepts, and formalizing them is still in progress. If so, here are some impressions.
The UX suggested by Graylog seems to be that dashboards are answers to questions and these questions generally do not change, so they are not supposed to be interactive. If so, this is in line with other UX designs of this kind. However, it seems that Graylog understands that someone may want to “tweak” questions, and thus provides the ability to “override” some of the details of these questions, most prominently with
- Adding a “filter” query to all widgets
- Overriding the time frame for all widgets
moreover, if I understand correctly, an enterprise feature called parameters provides the ability to augment dashboards with tweakable parameters (I suppose to make it easier or possible in cases where juggling queries and overrides would require technical knowledge and/or drive one insane).
You can see that in a way, dashboards being “simple and static” is already mostly out of the window. A power user can already twist and bend a dashboard, and an enterprise power user can do it more. Just to get the cat out of the bag, if the point is having a marketable feature for the enterprise, I can understand and others already went that route, though my impression is that it did them more bad than good in the long run (I am looking at you, Elastic) by poisoning their relationship with users. Here Graylog should be probably more upfront on what the UX it wants is, and if “power dashboards” are an enterprise-only thing, or not, and see how both professional customers and community users react.
On the other hand searches seem to be supposed to be, always from an UX perspective, more of a power tool, which requires more knowledge and maintenance, and may by more powerful, but may be less shareable and understandable to outsiders. Again, this is perfectly fine from a theoretical point, and present in other similar products. The dissonance here is that saved searches are presented almost exactly like dashboards, and seem to use the same tools, but for some reason they are also “made less convenient” for some aspects.
In the end, we are left with two “abstraction flavours” that in some sense share most of the pros but have different cons, and nothing more, calling in question if it makes sense to have them exists like they are now, e.g.
- Searches lack some of the presentation features of dashboards (e.g. tabs, being a “first class citizen” with their own section") but allow for extensive, even superior customization
- Dashboards would like to be presentation of data, and maybe nothing more, but still bow their head to giving users some control, but not much
- Additionally the enterprise “parameter” feature further muddies the water for dashboards, making them a way to answer to a spectrum of questions, and most prominently, making them interactive
These are just honest to heart opinions, I truly appreciate the work the folks at Graylog do, and it lets me do great things for free, so trying to give some suggestions is the minimum I could do, I hope it is clear that I do so without any hard feelings. I just feel that the dashboard/widget/sharing department needs some more attention to make Graylog a better product.
