We use the ELK stack to aggregate all of our service logs, then when we encounter an issue/bug we use Kibana's Discover tab to explore and correlate events. There's one task we repeatedly encounter and think the Discover mode could be enhanced to make it easier. The scenario is:
- We have an interesting value (e.g. a data record ID, a user session ID) that we filter on and it returns multiple log messages from various systems
- We identify one event X at time Y in system Z that looks interesting/suspicious
- Our question is "what else was happening in system Z before/around event X?"
- Today we apply a filter for system Z and a time range around Y, but this means we lose track of event X and need to locate it manually (browser search etc.) and this can be quite cumbersome.
One solution could be to add the ability to mark an individual record and have it highlighted on screen across all queries. Possibly having a way to quickly jump to highlighted events.
Does anyone have the same/a similar use case and have any thoughts?