{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/275","labels_url":"https://api.github.com/repos/elastic/kibana/issues/275/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/275/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/275/events","html_url":"https://github.com/elastic/kibana/issues/275","id":17201233,"number":275,"title":"Extract log event context","user":{"login":"mrdavidlaing","id":227505,"avatar_url":"https://avatars.githubusercontent.com/u/227505?v=3","gravatar_id":"","url":"https://api.github.com/users/mrdavidlaing","html_url":"https://github.com/mrdavidlaing","followers_url":"https://api.github.com/users/mrdavidlaing/followers","following_url":"https://api.github.com/users/mrdavidlaing/following{/other_user}","gists_url":"https://api.github.com/users/mrdavidlaing/gists{/gist_id}","starred_url":"https://api.github.com/users/mrdavidlaing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrdavidlaing/subscriptions","organizations_url":"https://api.github.com/users/mrdavidlaing/orgs","repos_url":"https://api.github.com/users/mrdavidlaing/repos","events_url":"https://api.github.com/users/mrdavidlaing/events{/privacy}","received_events_url":"https://api.github.com/users/mrdavidlaing/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/kibana/labels/4.5.0","name":"4.5.0","color":"ffffff"},{"url":"https://api.github.com/repos/elastic/kibana/labels/elasticsearch","name":"elasticsearch","color":"006600"},{"url":"https://api.github.com/repos/elastic/kibana/labels/enhancement","name":"enhancement","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"rashidkpc","id":1250387,"avatar_url":"https://avatars.githubusercontent.com/u/1250387?v=3","gravatar_id":"","url":"https://api.github.com/users/rashidkpc","html_url":"https://github.com/rashidkpc","followers_url":"https://api.github.com/users/rashidkpc/followers","following_url":"https://api.github.com/users/rashidkpc/following{/other_user}","gists_url":"https://api.github.com/users/rashidkpc/gists{/gist_id}","starred_url":"https://api.github.com/users/rashidkpc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rashidkpc/subscriptions","organizations_url":"https://api.github.com/users/rashidkpc/orgs","repos_url":"https://api.github.com/users/rashidkpc/repos","events_url":"https://api.github.com/users/rashidkpc/events{/privacy}","received_events_url":"https://api.github.com/users/rashidkpc/received_events","type":"User","site_admin":false},"milestone":null,"comments":55,"created_at":"2013-07-25T09:19:27Z","updated_at":"2015-08-05T08:40:26Z","closed_at":null,"body":"When troubleshooting the cause of an ERROR log event, its really helpful to be able to see the log event context - i.e, which, say, 10 log events occured before and after the specific ERROR log event.\r\n\r\nLoggly has a feature which does this quite nicely, as illustrated below\r\n![capture](https://f.cloud.github.com/assets/227505/854639/fd7c953e-f50a-11e2-9637-eecae9900435.PNG)\r\n\r\nI have 2 questions concerning this:\r\n\r\n1.  Is it feasible to add a similar feature to Kibana?\r\n2.  Are there any existing plans to add said feature?  (I'm happy to contribute development resources to assist or lead this if its possible)\r\n\r\nLastly, thanks!"},"comment":{"url":"https://api.github.com/repos/elastic/kibana/issues/comments/127916063","html_url":"https://github.com/elastic/kibana/issues/275#issuecomment-127916063","issue_url":"https://api.github.com/repos/elastic/kibana/issues/275","id":127916063,"user":{"login":"grantnd","id":4425678,"avatar_url":"https://avatars.githubusercontent.com/u/4425678?v=3","gravatar_id":"","url":"https://api.github.com/users/grantnd","html_url":"https://github.com/grantnd","followers_url":"https://api.github.com/users/grantnd/followers","following_url":"https://api.github.com/users/grantnd/following{/other_user}","gists_url":"https://api.github.com/users/grantnd/gists{/gist_id}","starred_url":"https://api.github.com/users/grantnd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grantnd/subscriptions","organizations_url":"https://api.github.com/users/grantnd/orgs","repos_url":"https://api.github.com/users/grantnd/repos","events_url":"https://api.github.com/users/grantnd/events{/privacy}","received_events_url":"https://api.github.com/users/grantnd/received_events","type":"User","site_admin":false},"created_at":"2015-08-05T08:40:26Z","updated_at":"2015-08-05T08:40:26Z","body":"+1\r\n\r\nWe posted our use case and a very simple solution to this in the Kibana forum as follows:\r\n\r\nWe use the ELK stack to aggregate all of our service logs, then when we encounter an issue/bug we use Kibana's Discover tab to explore and correlate events. There's one task we repeatedly encounter and think the Discover mode could be enhanced to make it easier. The scenario is:\r\n\r\n* We have an interesting value (e.g. a data record ID, a user session ID) that we filter on and it returns multiple log messages from various systems\r\n* We identify one event X at time Y in system Z that looks interesting/suspicious\r\n* Our question is \"what else was happening in system Z before/around event X?\"\r\n* Today we apply a filter for system Z and a time range around Y, but this means we lose track of event X and need to locate it manually (browser search etc.) and this can be quite cumbersome.\r\n\r\nOne solution could be to add the ability to mark an individual record and have it highlighted on screen across all queries. Possibly having a way to quickly jump to highlighted events."}}