Feature Request - Context for Queries

[polarbear1]

As we're starting to use NLS for different purposes in the organization, some of my users came forward with a request - would it be possible to do a "find" instead of a "search" on the dashboard?

By this, they mean that right now when you enter a query into the dashboard it will bring back messages which match (the "search"). What they want is a "find" where the dashboard will bring up the message searched for, but also the context in which it showed up. The idea that a particular message, depending on context, could be no big deal at all, or a huge problem. In other words, the dashboard would bring back the message searched for, along with some messages above and below in the context of that log file.

Right now, the best way to go about it is to do the search, and then remove the message query and apply the time/source constraints to effectively get you where you want to be. This is slow, and doesn't help workflow.

These are just some initial thoughts. Wondering if there is any real demand for this feature from others.

Cheers.

[jolson]

Currently there is not support for this feature, as Elasticsearch doesn't completely support all of the functionality required to get this working in Kibana. Github report for reference: https://github.com/elastic/kibana/issues/275

We strive to maintain parity with the latest Elasticsearch releases, so when this feature becomes available it shouldn't be long before it's integrated with Nagios Log Server. For now, the solution that you're using is the only way to accomplish what you'd like to do. Thank you for your feedback polarbear, I hope the cluster has been running well!