Rollback 3.2->3.1?

Hi @innominate227 @danielp,

  • if I got you correctly your problem is more about the field list and not about the quick values.
    Since you could do this:

  • @danielp I am sorry to hear that you miss automatically saving your widgets in the browser storage, but we think saving queries together with the widgets is helping more people in the long run.

  • In a future version we plan to make your default search configurable.

Thanks a lot for both of your input!

Thanks Konrad!
Actually it’s both, the fields list and the easy access to quick values. As I wrote, we’ve got many people using Graylog occasionally and for them it was much easier to navigate in the previous UI version.
Customizing the default search page would be a big improvement for us.
Best,
Daniel

for them it was much easier to navigate in the previous UI version

Maybe it’s just because they got used to it… :wink:

Not trying to blame you, just sharing real-life experience:
In my case we tried to live in new reality and tried to adopt new UI(I really wanted users to learn some new tricks) for about 3 weeks, but it was really painful.
Today I can confirm successful rollback is possible (even replacing repo took me some time to debug)

I just want to agree, the loss of quick values is significant in our daily workflow. Several core components seem to have been hidden behind “more clicks” now.

1 Like

So, is rollback to 3.1.4 possible after we’ve executed these curls from upgrade documentation?

No quick values. No sorting by timestamps. No surrounding messages.

Are there any time estimates for these things to reappear in the next versions of Graylog?

As for now, I’ve decided to rollback to 3.1 and pretend that 3.2 release didn’t happen.

1 Like

You will have to restore mongodb from backup and reinstall graylog. No simpler way.
In my case I fortunately had backup (usually I didn’t do it, coz multiple previous upgrades had no any issues) and was able to work around package manager, so I didn’t have to edit config files again.

@gimmic, @juris

I just want to have it clear. Since I mentioned already that “Quick Values” is now found under “Aggregate” (which we will rename to “Top values” or similar):

Graylog

Do you miss having the table together with the pie chart, do you miss accessing it without a extra click over the field list or what exactly is the problem?

Since QuickValues is not really gone I need to know what is missing when you write:

No quick values

Thanks for your input!

- Konrad

@konrad
Yes, pie chart with the table and extra clicks to get to the fields. It is not so trivial anymore. I receive a daily bunch of complains from users without technical background regarding quick values and surrounding messages.

Moreover, the fields list contains all the fields, rather than fields from the exact stream, it makes navigation even more confusing.

2 Likes

@juris, Okay! Thanks a lot for making it clearer for me!

Seconded with what @juris had to say. More clicks to get to the same data, reduced functionality in that a pie chart isn’t shown. Before, it was much more direct and quick to get “quick values”(as it should be). Sometimes you’re looking for the odd value out, sometimes you just want a high level view on the distribution of values in your query.

Everyone who uses graylog on my team misses this feature and the new workflow is not great.

4 Likes

@gimmic, Understood. Will bring this back to my team. Will see what will come out of it. Thanks a lot!

1 Like

One thing that I’m really missing in 3.2 from 3.1 is the Others part of a pie chart. Instead of seeing what percentage of all messages all I get is the relative percentage of the top N fields.
I also miss the ease of adding a field to the list of search results.
It seems like the focus is more on pre-defined dashboards and searches rather than dynamic discovery of possible issues. Is that a conscious decision or just a happenstance?

1 Like

Same issues for my users here after upgrading to 3.2.3
You need a lot more work(Clicks+typing) just to get what we had before and it’s slower probably because it needs to load/display all of those unrelated actions(I think I saw an git issue on this)
Btw. We used an graylog-plugin-quickvaluesplus-widget just to easy click(no typing) exclude from search. Thanks Bill and Tobias for that.
I see than with 3.2 we possibly don’t need this in the future.

I also miss tabs with rights for view
Retrieving the full query that is sent to ES
Retrieving the list of terms a message field value was indexed with
The list of indices the current search used to generate results
sorting by field

A rollback to 3.1 is in our mind if I manage to find those backups(perhaps an mongo auto-backup would help in the future)
I generally want to thank you for your effort developing the new UX but I think we should concentrate more on the other more important issues that need attention like supporting ES 7.x and parsing for syslog-ng like:

if there is any doubt on the usability of the new 3.2 UX why not put it up to vote on
https://graylog.ideas.aha.io/ and see how Version 3.3 would/should look like in the eye of users
I really like this democratic way of advancing an product. :slight_smile:

keep up the good job done 'til now

@reshippie

About the pie chart, that is a good observation, I think we missed that. I will open an issue for it.

I also miss the ease of adding a field to the list of search results.

Graylog (7)
or do you mean

Graylog (9)

I personally like the way you can work with the data now. But sure there is a focus on pre-defined dashboards. But we still see the search page as a way to explore your data.

There are 2 different uses of Graylog, IMHO. One is daily routine monitoring and dashbords working very well for it. Another one is incident response, non standard investigation, for this flexible search with quick values, surrounding messages, fast search terms modifying etc. is the best. Graylog always worked good in both areas, IMHO, there is no reason to bring the balance to one or another side. And, yes, the voting idea seems good.

1 Like

I mean the the second, adding it to the table. As others have said, it used to be a little scrolling and a single click to add it. Now it’s either:

  1. Open message
  2. Click desired field
  3. “Add to table”
  4. Close message

or

  1. X2 Fields on sidebar
  2. Type/scroll to desired field, I do like seeing what Type each field is
  3. Click desired field
  4. “Add to all tables”
  5. Close sidebar

The fact that sidebar has been taken away and there isn’t a way to bring it back is frustrating. Would it be possible to have that available as a widget we could add?

So in general, for all who answered here: anybody happy with the collapse-able sidebar?

I know from some users at least you like it more that way.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.