Improve histogram data sampling

[edmundoa]

Problem description

In situations where histograms contain few relevant data points, histograms may appear empty due to the algorithm we use to down-sample the data. The problem is specially bad when graphs have a small width, and histograms include many data points (either by spanning over a long period of time, or by using a small resolution).

For instance, a graph including a single data point ("result":{"1470221520":1}), may end up looking like this:

This is the result of the same graph, just resized to be wider:

Steps to reproduce the problem

1. Do a search over the last day with few results
2. Create a search results widget using minute as resolution
3. Once on the dashboard, make the widget narrow, to increase the chances the problem occurs
4. See how some (or all) data points appear and disappear "randomly"

   Environment

   • Graylog Version: 2.0.3 / 2.1.0-beta.2

[edmundoa]

I was playing a bit with this, and trying to adapt our code to use: https://github.com/d3fc/d3fc-sample. So far the Largest Triangle Three Buckets algorithm seems to do a really nice sampling. I don't want to spend too much time on this right now (this would require quite a lot of testing to ensure it works in many other common cases), but I wanted to add my findings.

[bernd]

@edmundoa Is this still an issue with the new widgets in the new search? Thank you!