Selected fields cannot be unselected

[jskrivseth]

This is very minor, but in 1.1.6, if you perform a search and select a field for display (e.g. "UserName"), then you modify the search in such a way to filter out all records that contain the field "UserName", it is not possible in the UI to unselect the (now always blank) "UserName" field. You can of course manually remove the field from the query string and refresh the page as a workaround.

Suggest that the field list shown in the UI be the union of the fields specified in the query string and the available fields from the result set.

[edmundoa]

Hi,

I think you can remove the field from the UI by clicking on "List all fields" at the bottom of the sidebar, and then deselecting the one you don't want to display any more.

Regarding your suggestion, I agree that it would be a nice feature, but it would also be computationally expensive. In order to check if the field has a value on any of the results, we would have to load all results for your search from ES, and check if any selected field has a value. Loading all those results is really expensive, that's why we only fetch results for the current page when you do a search. The other problem is that the amount of displayed fields may be arbitrarily long, and each selected field would have a high performance penalty.

[jskrivseth]

Thanks Edmundo. I should use a different example to illustrate. Imagine you perform the query:

"exists:UserName"

and you tick the UserName field for display. Now you change the query to

"missing:UserName"

and submit. The now blank UserName field is still presented and cannot be unchecked even if you show all fields because the field doesn't exist in the result set.

Regarding the suggested behavior, it shouldn't require checking if the result actually contains the field. If the UI is presenting the field as above, it would be helpful to offer a method to hide it. One way to do that would be building the fields list exactly as you do now, based on the result set, and after processing the result set, if any selected field was not in the result (current page or all), add it to the field list anyway. In other words, always append any missing selected fields to the field list, regardless of what is in the result set.

Another user reported this, so I'm just passing it along. It's definitely a minor quirk. :)

Thanks again for all that is Graylog!

On Mon, Aug 31, 2015 at 3:24 AM, Edmundo Alvarez notifications@github.com wrote:

Hi,

I think you can remove the field from the UI by clicking on "List all fields" at the bottom of the sidebar, and then deselecting the one you don't want to display any more.

Regarding your suggestion, I agree that it would be a nice feature, but it would also be computationally expensive. In order to check if the field has a value on any of the results, we would have to load all results for your search from ES, and check if any selected field has a value. Loading all those results is really expensive, that's why we only fetch results for the current page when you do a search. The other problem is that the amount of displayed fields may be arbitrarily long, and each selected field would have a high performance penalty.

— Reply to this email directly or view it on GitHub https://github.com/Graylog2/graylog2-web-interface/issues/1573#issuecomment-136312029 .

[edmundoa]

Hi Jesse,

I just tried to follow your last example and I could deselect the field after clicking on "List all fields". Probably the difference is that your installation contains way more fields than mine. Could you try increasing the field_list_limit setting in the Graylog web interface configuration file? That should make it appear in the "all fields" list.

Adding the selected fields to the list would of course make sense, and should be easy enough to do. In the meantime you could try playing with field_list_limit :)