Issuing a search in a dashboard without stream filters does not search from all streams

[ottorei]

Expected Behavior

The search widget from dashboard should search from all streams if no streams are configured as a filter.

Current Behavior

When stream search widget has no streams attached to it, it should search from all the streams like the tooltip says. However, it does not do this. The search on the search-page works correctly without any streams selected. The dashboard also return the messages when each and every stream is selected on the widget settings but will not work with empty selection. The empty selection probably attempts to search from the All Messages stream.

Possible Solution

Search all streams if the streams filter is empty on any dashboard widget.

Steps to Reproduce (for bugs)

1. Make a stream, remove matches from All Messages on the stream settings
2. Make a dashboard or copy an existing search without stream filters
3. Attempt to search something that should be present in the newly created stream but not in the All Message from the dashboard

Context

Trying to copy existing premade searches to a dashboard with correct premade filters.

Your Environment

• Graylog Version: 6.0.7-1
• Java Version: OpenJDK Runtime Environment (build 17.0.12+7-Ubuntu-1ubuntu222.04)
• OpenSearch Version: 2.9.0
• MongoDB Version: 7.0.14
• Operating System: Ubuntu 22.04
• Browser version: Firefox 128.3

[drewmiranda-gl]

If i'm understanding correctly, are you saying that if a new stream is creating, your dashboard(s) is unable to find any messages in this stream without explicitly adding the stream to the list of streams in the search for that specific dashboard widget? I'm having a difficult time understanding what is broken or what issue you have specifically.

Are you able to provide a series of screenshots or a video/screen recording?

Graylog already, by default, will search for messages in ALL streams, unless an explicit list of streams is provided for the search.

Is the issue you are having unique to dashboards or does it happen with the search page?

[ottorei]

If i'm understanding correctly, are you saying that if a new stream is creating, your dashboard(s) is unable to find any messages in this stream without explicitly adding the stream to the list of streams in the search for that specific dashboard widget? I'm having a difficult time understanding what is broken or what issue you have specifically.

Are you able to provide a series of screenshots or a video/screen recording?

Graylog already, by default, will search for messages in ALL streams, unless an explicit list of streams is provided for the search.

Is the issue you are having unique to dashboards or does it happen with the search page?

The search page does indeed search all possible streams when none are selected, just like the tooltip on the page explains. However, executing the same search on a dashboard does NOT search ALL streams.

[drewmiranda-gl]

What does your widget configuration look like? For dashboards each individual widget has a search and stream box. Are you able to share a screenshot? Also are you able to export the dashboard as a content pack and share?

[ottorei]

The settings are just like in your example screenshot. No matter what relative time range or text filter I put in the widget - it never finds any messages which are not in the "All Messages" stream if I dont explicitly put all the streams in the filter on the dashboard widget. On the Search-page this works without putting these streams there.

The dashboard widget seems to find only messages which are in the "All Messages" stream when no stream is explicitly specified as a filter.

Additional details: the message I am looking for is in a separate stream and the stream settings has the option remove from all messages ticked in so the message does not exist in "All Messages" stream.

[dennisoelkers]

Hey @ottorei,

this bug report is very surprising to me, because I use that functionality all the time. I cannot verify that this is an issue in recent versions. There has to be more to it in your local setup that prevents it from working. Maybe your index ranges need to be recalculated? Can you try creating a widget on search that shows messages and copy it to a dashboard to verify that it's not showing these in that context anymore?

[ottorei]

Hey @ottorei,

this bug report is very surprising to me, because I use that functionality all the time. I cannot verify that this is an issue in recent versions. There has to be more to it in your local setup that prevents it from working. Maybe your index ranges need to be recalculated? Can you try creating a widget on search that shows messages and copy it to a dashboard to verify that it's not showing these in that context anymore?

This is how I have created the searches in the dashboard originally. Not sure about the index range recalculation, why would the dashboard's search widget not search every stream but the search page itself does? Also, this issue is present on 6.0.7-1 - did you test on this version?