Logs UI disable "failed to find message" line

Elastic Observability Logs
1

Hello!

Loving the new Logs UI functionality. Makes checking the logs of distributed systems much quicker and more pleasant to use.

While it works well, there's one pet peeve I have - when a document does not have the "message" field, it will show the line as "failed to find message" in the Logs UI.

This is a problem because I have indexes sorted by topics, for an example Slurm information is in the "slurm-*" indexes. There's three different kinds of information:

  • Slurm jobs information
  • Slurm nodes information
  • Slurm logs from all the nodes

Now the first two do not need a message field, all the data is in different fields that are used to visualize and search on. And there's thousands of such documents in between some log lines.

Having log lines separated by thousands of lines of "failed to find message" is not very useful. I wish I could either turn that line off, or somehow hide it and save the setting permanently.

I can currently circumvent this by using a search bar query, but every time you go to the page you need to rewrite the query. Possibility to save and default the search would help as well.

Hope my two cents are helpful.

2

Hi @Eilyre, thank you for the feedback.

I agree that the usefulness of these error messages is very low unless you're debugging something. Unfortunately there is no way to disable it completely right now.

As you correctly pointed out a query can be used to avoid them. The query is persisted in the URL. So if you load the page via a bookmark that includes that query, it should be restored. Maybe that helps a bit until we have improved the situation.

The GitHub issue elastic/kibana#26759 is related. You can follow the progress there or add comments if you like.

3

Thank you, I guess a bookmark currently works for me. Will wait a few versions, I'm sure the plugin will grow in functionality.

But otherwise thank you for the cool functionality! Logs UI is definitely a very useful utility, and as it grows out of beta, I anticipate huge usage for it.