Canvas Timelion datasource not returning results (using custom timeField)

Elastic Stack Kibana
1

Running ES 6.2, installed latest Canvas, and I'm unable to get the timelion datasources working correctly. All data returned is 0.

I loaded a few million documents into an index, timeseries data, for Feb 2018. I'm easily able to use this data directly in timelion with a simple query such as .es(index=callrecord*,timefield=startDate) with the time selector set to last 60 days. I get a nice line graph showing the count of my records.

In Canvas, I placed a time selector, set it to last 90 days, and then dropped in a data table. Modified the code to this, using the exact same timelion query:

filters | timelion query=".es(index=callrecord*,timefield=startDate)" | table perPage=1000 | render

What I end up with is a 3 column table @timestamp, value #, and label:

2018-02-15T00:00:00-0800 0 q:* > count
2018-02-15T12:00:00-0800 0 q:* > count
...

All the values are 0, when I'm quite sure they're not.

2

It's possible that the timelion function isn't using the filters context correctly. If you remove the filters part from the expression (as below), do you get data in the table?

timelion query=".es(index=callrecord*,timefield=startDate)" | table perPage=1000 | render

3

That's the issue! I removed the filters from the front, and now I have data being returned.

What's odd is that the filters seemed to be applied (it filtered the correct date ranges) - just all the values were zero.

4

Oh, actually, maybe it's not a bug after all.

Can you check the expression on the time picker element and make sure it's using the correct field? By default, you'll see this:

timefilterControl compact=true column=@timestamp

But in your case, the time column is startDate, not @timestamp.

I suspect setting it to timefilterControl compact=true column=startDate will make it function correctly.

5

Makes sense. I set the timeFilter's column property to startDate, confirmed the code reflected what you suggested, but it didn't change the data table's results. The data table still shows @timestamp as the first column of the results.

Debug render output of the filters | timelion output looks like this:

{
"@timestamp": 1512896400000,
"value": 0,
"label": "q:* > count"
},
{
"@timestamp": 1512939600000,
"value": 0,
"label": "q:* > count"
},
{
"@timestamp": 1512982800000,
"value": 0,
"label": "q:* > count"
},
{
"@timestamp": 1513026000000,
"value": 0,
"label": "q:* > count"
},
{
"@timestamp": 1513069200000,
"value": 0,
"label": "q:* > count"
},

6

Thanks, that's helpful. It's probably a bug then. Or maybe I'm just using the time picker wrong myself :wink:

I'll open an issue and we'll look into it.

1 Like
7

@Jim_Boutcher are you still running into this issue with the newest Canvas release? We tried to replicate it locally and everything seems to be working the way it should.

8

@Joe_Fleming - works perfectly now! Thank you!

1 Like
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.