Canvas - Timefilter issue

[r.pollak (Rainer)]

Hi together,
without using a time filter, the graph shows several data.
All date have a timestamp of 23. September 2021

After adding a time filer with a time range "last year" the graphs shows no more data.

Can you point me in the right direction?

Regards,
Rainer

[Felix_Roessel]

Is that the only filter you have in your workpad?

[r.pollak (Rainer)]

Hi Felix,
thanks for your fast response.
No, the only filter is the time filter "last year". All my data are in this time interval.
I have added the debug filter for my workpad.

[Felix_Roessel]

The filter looks fine. What about the expression in your visuals? Can you copy / paste them too, pls?

[r.pollak (Rainer)]

Here are the two expressions:

filters
| esdocs index="index-csv" fields=""
| math "size('Computer Name')"
| metric "Records"
metricFont={font size=48 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center" lHeight=48}

labelFont={font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" color="#000000" align="center"} metricFormat="0,0.[000]"
| render

filters

| esdocs index="index-csv" fields=""
| pointseries x="Timestamp" y="size('Computer Name')" color="Computer Name"
| plot defaultStyle={seriesStyle bars=0.75} legend="ne"
| render

[Felix_Roessel]

Well...

your Timefilter is filtering on the file @timestamp.
Your pointseries is using the field Timestamp.

Does your index has the @timestamp field?

[r.pollak (Rainer)]

Yes, I have also created several visuals for a dashboard based on this index filtering on @timespamp without any problems,

{
  "mappings": {
    "_doc": {
      "_meta": {
        "created_by": "file-data-visualizer"
      },
      "properties": {
        "Computer Name": {
          "type": "keyword"
        },
        "Context": {
          "type": "keyword"
        },
        "Duration": {
          "type": "keyword"
        },
        "Event": {
          "type": "keyword"
        },
        "Extended Id": {
          "type": "keyword"
        },
        "Id": {
          "type": "keyword"
        },
        "Level": {
          "type": "long"
        },
        "Media": {
          "type": "keyword"
        },
        "Page": {
          "type": "long"
        },
        "Page Duration": {
          "type": "keyword"
        },
        "Previous Page": {
          "type": "long"
        },
        "Project": {
          "type": "keyword"
        },
        "Timestamp": {
          "type": "keyword"
        },
        "Title": {
          "type": "keyword"
        }
      }
    }
  }
}

[Felix_Roessel]

Your Timestamp field is a keyword and not an actual date field.
This needs to get converted during ingest or using a runtime field.
You may see data on a normal dashboard as you also can see data in canvas.
But the time picker for the normal dashboard is most likely disabled as you dont have any date field in your mapping.

[r.pollak (Rainer)]

Hi Felix,

thanks for your create support!
Have a great weekend!
Regards,
Rainer

[r.pollak (Rainer)]

Sorry, but I have changed the format do date:

some outcome.

[Felix_Roessel]

In canvas you need to configure the timefilter to filter your custom time field. The @ before @timestsmp is part of the default timestamp name.
Your time field is called Timestamp without the @ sign. Thats a difference.

The configuration is called Column in the sidebar

[r.pollak (Rainer)]

Smal change .. big difference!
Thanks