UX design for zar

[siskojr]

Request

As a User of zar, I want to use Brim so that the search experience is graphical, intuitive and familiar to desktop-scale search.

User Flow for Search in zar world

1. User types endpoint IP@ and Brim connects to zqd endpoint.
2. Brim presents available spaces and user selects an Archive type space. Search pane will turn blue to highlight that the user is now in zar mode.
3. User types a search query, example, 192.168.0.53.
4. Hits happen and Brim presents a list of chunks and time stamps of the hits to the user.
5. User clicks on a hit and a new tab is opened with the chunk as a space. User can now perform detailed search hunt, similar to desktop-scale and with regular ZQL options.

UX design for prototype V0

Figure: Blue search in Zar world after Archive space is selected by the user.

The design follows the layout structure of endpoint location (server IP@ and port) and space. In zar scenario, the “archive default” identifies a special type of space that represents a very long tail of years of logs.

Time Span: The objective would be to provide a time span from the “first chunk" indexed to the most recent chunk. This gives a quick idea of the depth/length of the archived data.

Search results: We will get a list of log like lines for the hit results, a line per chunk.

After a chunk is selected  a new tab is opened with the chunk as a space. As a desired design property, the chunk space name should keep context of the blue search previously done.

Figure: Regular search UI where chunk1.zng becomes the space to look at. A desired property of the design would be to provide context of the search. A visual clue for the user so that the user can relate the archive space hits and the chunk space that got opened as a result. Some examples:

1. Change the tab color of an archive type space from the current black (when the tab is not active) to a blue tab.
2. Another option using the text of the space name. For example, “default chunk1” related to the archive type space with the name “default”.

Reference information

The architecture of Zar for an implementation at a customer server is illustrated below. Figure: zar architecture.

Tools related to Ice Age:

• zar ingest: Read a log tree and create chunks.
• zar index: index certain fields (IP@, file hash, etc) to provide fast search of chunks.
• zar find: based on input values, locate all the chunks that contain those values. These chunks are the "active chunks".

On the server side, a zq(d) component communicates with Brim using REST. The server can host different types of spaces and will be able to identify the type:

• Regular space: desktop-scale space. space that can be opened with Brim desktop.
• Archive space: zar space that can contain years of logs.

User can now only interact with Brim to do search in a server that has been configured for zar using CLI tools.

[jameskerr]

This is mostly done, subsequent designs can be made on the fly.

Some designs: https://www.sketch.com/s/4b2957a2-910e-403c-9fda-617de055c061/p/index-search

[siskojr]

Great work. Thanks