Skip to content

Slicing intermediate changes for stepwise improvements#25363

Merged
janheise merged 15 commits intomasterfrom
slice/intermediate-part1
Mar 23, 2026
Merged

Slicing intermediate changes for stepwise improvements#25363
janheise merged 15 commits intomasterfrom
slice/intermediate-part1

Conversation

@janheise
Copy link
Copy Markdown
Contributor

@janheise janheise commented Mar 18, 2026

Description

Motivation and Context

Part 1 of a series of improvements for the slicing feature

/nocl unreleased feature

/prd https://github.com/Graylog2/graylog-plugin-enterprise/pull/13558

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

  • [] Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Refactoring (non-breaking change)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have requested a documentation update.
  • I have read the CONTRIBUTING document.
  • I have added tests to cover my changes.

@janheise janheise requested a review from dennisoelkers March 19, 2026 09:04
void scrollEvents(String queryString, TimeRange timeRange, Set<String> affectedIndices, Set<String> streams,
List<UsedSearchFilter> filters, int batchSize, ScrollEventsCallback resultCallback) throws EventProcessorException;

Map<String, Long> aggregateSlices(String queryString, TimeRange timerange, Set<String> affectedIndices,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is up to you to decide, but for me, "slices" wording seems a lot like FE-wording, and I would rather avoid it in Indexer-access methods, trying to use more general aggregate/grouping/bucketing naming.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's keep it for now

Set<String> eventStreams, String filterString, Set<String> forbiddenSourceStreams,
Map<String, Set<String>> extraFilters, String slicingColumn, int maxBuckets);

Map<String, Long> aggregateRangeSlices(String queryString, TimeRange timerange, Set<String> affectedIndices,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also have a feeling this methods are not in a proper class...
MoreSearchAdapter feels like an adapter for scrolling and chunking, and those methods intentionally return 0 results and just provide aggregations results.

If you agree to move it elsewhere, I am fine with doing it in a separate PR.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The MoreSearch Adapter is in the Events package. So all this is Events based. Currently, I'm only slicing in that area. So let's keep it for now.

@janheise janheise requested a review from luk-kaminski March 20, 2026 10:20
Copy link
Copy Markdown
Contributor

@luk-kaminski luk-kaminski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It has been decided we can merge and polish the code in the follow-up PRs.

@janheise janheise merged commit 7b7e574 into master Mar 23, 2026
24 checks passed
@janheise janheise deleted the slice/intermediate-part1 branch March 23, 2026 09:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants