@konrad
Yes, pie chart with the table and extra clicks to get to the fields. It is not so trivial anymore. I receive a daily bunch of complains from users without technical background regarding quick values and surrounding messages.
Moreover, the fields list contains all the fields, rather than fields from the exact stream, it makes navigation even more confusing.
Seconded with what @juris had to say. More clicks to get to the same data, reduced functionality in that a pie chart isn’t shown. Before, it was much more direct and quick to get “quick values”(as it should be). Sometimes you’re looking for the odd value out, sometimes you just want a high level view on the distribution of values in your query.
Everyone who uses graylog on my team misses this feature and the new workflow is not great.
@gimmic, Understood. Will bring this back to my team. Will see what will come out of it. Thanks a lot!
One thing that I’m really missing in 3.2 from 3.1 is the Others part of a pie chart. Instead of seeing what percentage of all messages all I get is the relative percentage of the top N fields.
I also miss the ease of adding a field to the list of search results.
It seems like the focus is more on pre-defined dashboards and searches rather than dynamic discovery of possible issues. Is that a conscious decision or just a happenstance?
Same issues for my users here after upgrading to 3.2.3
You need a lot more work(Clicks+typing) just to get what we had before and it’s slower probably because it needs to load/display all of those unrelated actions(I think I saw an git issue on this)
Btw. We used an graylog-plugin-quickvaluesplus-widget just to easy click(no typing) exclude from search. Thanks Bill and Tobias for that.
I see than with 3.2 we possibly don’t need this in the future.
I also miss tabs with rights for view
Retrieving the full query that is sent to ES
Retrieving the list of terms a message field value was indexed with
The list of indices the current search used to generate results
sorting by field
A rollback to 3.1 is in our mind if I manage to find those backups(perhaps an mongo auto-backup would help in the future)
I generally want to thank you for your effort developing the new UX but I think we should concentrate more on the other more important issues that need attention like supporting ES 7.x and parsing for syslog-ng like:
if there is any doubt on the usability of the new 3.2 UX why not put it up to vote on
https://graylog.ideas.aha.io/ and see how Version 3.3 would/should look like in the eye of users
I really like this democratic way of advancing an product. 
keep up the good job done 'til now
About the pie chart, that is a good observation, I think we missed that. I will open an issue for it.
I also miss the ease of adding a field to the list of search results.
or do you mean
I personally like the way you can work with the data now. But sure there is a focus on pre-defined dashboards. But we still see the search page as a way to explore your data.
There are 2 different uses of Graylog, IMHO. One is daily routine monitoring and dashbords working very well for it. Another one is incident response, non standard investigation, for this flexible search with quick values, surrounding messages, fast search terms modifying etc. is the best. Graylog always worked good in both areas, IMHO, there is no reason to bring the balance to one or another side. And, yes, the voting idea seems good.
I mean the the second, adding it to the table. As others have said, it used to be a little scrolling and a single click to add it. Now it’s either:
or
The fact that sidebar has been taken away and there isn’t a way to bring it back is frustrating. Would it be possible to have that available as a widget we could add?
So in general, for all who answered here: anybody happy with the collapse-able sidebar?
I know from some users at least you like it more that way.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
