I’m having a hard time understanding how sources selection works. Right now, I’m after the most basing chart: the number of messages coming in from servers connected. However, I’d like to limit the chart to just show me N, say 5, noisiest servers.
By default the graph tries to show all (or a majority), but with 50+ servers the graph becomes incomprehensible. I’ve seen Sources Tab in Graylog 3.2.1 thread and I thought that’s the answer, but my aggregation behaves not as expected.
To illustrate, if I choose a single source, that indeed show me just the noisiest single server.
However if I increase the sources number to “2”, the server list jumps to 18 and the selection seems random:
So, my questions are:
- What’s up with selecting sources this way? Is what I’m seeing expected?
- What’s the recommended way to limiting data sources to be taken into account, if I want to always display 5 or 10 noisiest servers for a given search over a time period?
ps. We’re seeing this on Graylog 3.2.4+a407287 (AdoptOpenJDK 11.0.6 on Linux 5.3.0-40-generic) / Ubuntu 18.04.4 LTS; filebeat is the main source of data into Graylog.