When reading logs the old-fashioned way on a unix terminal with text search, my frequent practice is to search / grep to zero in on an event of interest, then read messages above and below to see what was happening just before and after the event. But I haven't found a way to replicate this practice in the graylog web interface. I can do the first part -- search to find the event of interest -- but then I cannot easily request display of messages not necessarily matching the entire search but closely spaced in time from the found target.
Ideally, there would be a button in the detail panel for the message saying "search around this time", which then autofills the search time portion with some range around the time of the chosen message, and the search term portion with your existing search (which you can then cut down, for example to just select the source in question). Even better would be to have a third "time selection mode" in addition to relative and absolute start/end, which is "relative to a point in time". The point in time could be entered or prefilled from clicking the detail panel, and then sliders or relative time dropdowns for before/after specify the range. But is there already a way to do this stuff easily that I'm just missing? Thanks. -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
