###1. Get the unique list of sources
This should aggregate the list of sources from may be the past one week indices. Logstasher takes into account the past one month index. This will power the sources dropdown on the search toolbar
###2. Search API
- The default filter could be the
Last 30sand show all the log events since then. UI will pass fully qualified timestamp of the form2016-12-10T10:07:23.339asfromfilter - Some form of pagination api. Details upto implementer
- Provide datetime range filter that takes
fromandtovalues. Both would be fully qualified timestamp values of the form2016-12-10T10:07:23.339passed as UTC.tounless specified is now. - Ability to filter by a specific
trace_id - Ability to filter by log level be it
ERRORorWARN - Ability to filter by custom keywords. Keywords by default should support AND operator. OR as alternate operator if supported is nice to have. This will search for all keywords within a single event's
messagefield - Ability to search for keywords within a single request. For all log events with the same
trace_id, check ifJohn Doeandregistered successfullyare present distributed across same or multiple events'messagefield - Streamed tailing api (Nice to have)
###3. Metrics (all with ability to time slice. Current month might be default)
- Show the top 5 slowest requests
- Show the requests with errors
- Source dependency graph. Given an app like QuoteTrackerApi, show a graph of all the other apps that it is dependent on