Cant access machine learning index from Canvas

[Incauto]

Hi, Im trying to display data from the .ml-anomalies-* index on Canvas, but it doesnt show the values in the metric visualization. (the index pattern exists)

SELECT COUNT(*) as count_documents FROM ".ml-anomalies-*" WHERE
anomaly_score > 75 AND job_id = 'my-job 

when I run the query I get data

then I use the field that I need in the visualization

but I dont get the value displayed

what is the problem here?

Elastic 7.5

[richcollier]

Pretty sure you need the math function:

filters
  |  essql 
  query="SELECT COUNT(*) as count_documents FROM \".ml-anomalies-*\" WHERE anomaly_score > 75 AND job_id = 'farequote_demo'"
  | math "count_documents"
  | metric "anomalies" 
    metricFont={font size=48 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center" lHeight=48} 
    labelFont={font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center"}
    metricFormat="0,0.[000]"
  | render

Yields:

[Incauto]

Hi Rich, I have the math function

There is no known issues on canvas accessing the system indices? is the only thing that I can think of....

[richcollier]

No, my example is from a Canvas workpad that is running that exact query to .ml-anomalies-*

Do you have a time filter on your Canvas workpad (on any of the panels, not just the visible one) that is limiting the scope of your query to a certain date range where there are no actual anomalies?

[Incauto]

I have anomalies in the last 7 days

I just have a time filter element in the canvas set to 7 days and still nothing is showing,

The strange thing is if I remove the time filter element from the canvas the metric works....so the problem seems to be the time filter...

Maybe because the time field in the .ml-anomalies-* index is "timestamp" not "@timestamp" like in a regular index?, maybe the time filter doesnt recognize the field?

the problem is that I need the time filter in the canvas

[richcollier]

Ah yes, that's the issue. You could perhaps investigate creating a field alias in the .ml-anomalies-* index to map timestamp to an alias field called @timestamp