Canvas Metric Element: Unique count

Elastic Stack Kibana
1

Hi All,

I'm trying to create my first event canvas workpad.
I have an index that contains at least 100K unique hostnames. But when I create a metric element to display count of unique hostnames, it show maximum count as 1000.
Now the queries that I have are,

  1. Does canvas pulls all the data from index or is it timebound? If it is timebound then what is the default value for time duration for which it pulls data by default?
  2. Event though I add a time filter element and select a time period as 24 hrs, it still show maximum metric value as 1000. Why is that?
  3. Does it use HyperLog++ algorithm like Elasticsearch cardinality aggregation to calculate possible unique values?
  4. Is it at all possible to show count of unique values if there is such high variation in data?

Thanks,
Darshan

2

I worked with canvas a little and I guess this is what I learned.

  1. Does canvas pulls all the data from index or is it timebound? If it is timebound then what is the default value for time duration for which it pulls data by default?
    Ans : By default. It processes all the data. Elasticsearch Raw Docs and Elasticsearch SQL both the inputs will process all data present in mentioned index if the query asks for all documents, If specific field is mentioned to fetch the values for then it limits the output, mu guess is to 1000 entries.
    Best way to pull data for specific time is to use timefilter using expression editor.

  2. Event though I add a time filter element and select a time period as 24 hrs, it still show maximum metric value as 1000. Why is that?
    Ans: This looks like a default behavior when specific fields are queried.

  3. Does it use HyperLog++ algorithm like Elasticsearch cardinality aggregation to calculate possible unique values?
    Ans : Not sure still.

  4. Is it at all possible to show count of unique values if there is such high variation in data?
    Ans: I havn't found a way to show unique values for a specific fields as it always returns maximum of 1000 values.

3

The count defaults to 1000 but it can be overridden: https://www.elastic.co/guide/en/kibana/current/canvas-server-functions.html#_essql

Please note that this count parameter of the essql function is not the same as LIMIT in the actual SQL expression.

4

Hi Robert,

This will require me to know the exact number of results I must get.
What I was looking for is the unique number present in the data.

Regards,
Darshan

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.