Can't split series on visualization

Elastic Stack Kibana
1

Hey,

bit of a weird one here. all my visualizations that do a split series aggregation seem to have stopped working.

this happened about the same time that i had to rebuild my main node, so i suspected it was corrupted data. However, even recreating the searches it still doesn't seem to be working quite right.

image
image.png1562×686 30.6 KB

if i remove the split series aggregation, all works well again.

Visualization is as follows:

{
  "title": "Modem Speeds",
  "type": "line",
  "params": {
    "addTooltip": true,
    "addLegend": true,
    "legendPosition": "right",
    "showCircles": true,
    "interpolate": "linear",
    "scale": "linear",
    "drawLinesBetweenPoints": true,
    "radiusRatio": 9,
    "times": [],
    "addTimeMarker": false,
    "defaultYExtents": false,
    "setYExtents": false,
    "grid": {
      "categoryLines": false,
      "style": {
        "color": "#eee"
      }
    },
    "categoryAxes": [
      {
        "id": "CategoryAxis-1",
        "type": "category",
        "position": "bottom",
        "show": true,
        "style": {},
        "scale": {
          "type": "linear"
        },
        "labels": {
          "show": true,
          "truncate": 100
        },
        "title": {
          "text": "@timestamp per 10 minutes"
        }
      }
    ],
    "valueAxes": [
      {
        "id": "ValueAxis-1",
        "name": "LeftAxis-1",
        "type": "value",
        "position": "left",
        "show": true,
        "style": {},
        "scale": {
          "type": "linear",
          "mode": "normal",
          "setYExtents": false,
          "defaultYExtents": false
        },
        "labels": {
          "show": true,
          "rotate": 0,
          "filter": false,
          "truncate": 100
        },
        "title": {
          "text": "Kbit"
        }
      }
    ],
    "seriesParams": [
      {
        "show": "true",
        "type": "line",
        "mode": "normal",
        "data": {
          "label": "Downstream Speed",
          "id": "1"
        },
        "valueAxis": "ValueAxis-1",
        "drawLinesBetweenPoints": true,
        "showCircles": true,
        "interpolate": "linear",
        "radiusRatio": 9
      },
      {
        "show": true,
        "mode": "normal",
        "type": "line",
        "drawLinesBetweenPoints": true,
        "showCircles": true,
        "interpolate": "linear",
        "data": {
          "id": "3",
          "label": "Upstream Speed"
        },
        "valueAxis": "ValueAxis-1"
      },
      {
        "show": true,
        "mode": "normal",
        "type": "line",
        "drawLinesBetweenPoints": true,
        "showCircles": true,
        "interpolate": "linear",
        "data": {
          "id": "5",
          "label": "Attainable Downstream Speeds"
        },
        "valueAxis": "ValueAxis-1"
      },
      {
        "show": true,
        "mode": "normal",
        "type": "line",
        "drawLinesBetweenPoints": true,
        "showCircles": true,
        "interpolate": "linear",
        "data": {
          "id": "6",
          "label": "Attainable Upstream Speeds"
        },
        "valueAxis": "ValueAxis-1"
      }
    ],
    "type": "line"
  },
  "aggs": [
    {
      "id": "2",
      "enabled": true,
      "type": "date_histogram",
      "schema": "segment",
      "params": {
        "field": "@timestamp",
        "interval": "auto",
        "customInterval": "2h",
        "min_doc_count": 1,
        "extended_bounds": {}
      }
    },
    {
      "id": "4",
      "enabled": true,
      "type": "significant_terms",
      "schema": "group",
      "params": {
        "field": "DataSource.raw",
        "size": 4
      }
    },
    {
      "id": "1",
      "enabled": true,
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "DownstreamSync",
        "customLabel": "Downstream Speed"
      }
    },
    {
      "id": "3",
      "enabled": true,
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "UpstreamSync",
        "customLabel": "Upstream Speed"
      }
    },
    {
      "id": "5",
      "enabled": true,
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "AttainableDownstream",
        "customLabel": "Attainable Downstream Speeds"
      }
    },
    {
      "id": "6",
      "enabled": true,
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "AttainableUpstream",
        "customLabel": "Attainable Upstream Speeds"
      }
    }
  ],
  "listeners": {}
}

The search on the data is very simple, Type:broadcombeat. Which is the datasource for all the data I'm trying to graph.

Visualization is set to do the split series on DataSource.raw, which previously worked.
Data is still structured in the way inwhich it should handle nicely.
image

i suspect there may have been some query logic changes that i'm hitting, but nothing in change logs or anything stick out at me.

2

You didn't update kibana or elasticsearch right ? This just suddenly broke ?

3

Highly likely i updated it overnight and didnt test, thus not linking to a version change.
I have since updated the whole ELK stack twice expecting it was just an error in the kibana build.

but regardless, I've been unable to see any version changes that would add up to this.

I'm running Kibana 5.6.9
JVM: 1.8.0_171
ES: 5.6.9

4

Worked this out atlast.

"aggs": {
        "4": {
          "significant_terms": {
            "field": "DataSource.keyword",
            "size": 2
          },
          "aggs": {
            "1": {
              "avg": {
                "field": "DownstreamSync"
              }
            },
            "3": {
              "avg": {
                "field": "UpstreamSync"
              }
            },
            "5": {
              "avg": {
                "field": "AttainableDownstream"
              }
            },
            "6": {
              "avg": {
                "field": "AttainableUpstream"
              }
            }
          }
        }
      }

aggregations are all working again.

Change was .raw to .keyword - looking over changelogs for .keyword.... All makes sense now. Wups.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.