Data from rollup indice is empty in visualisation

Elastic Stack Kibana
1

Hi there.

I've setup 3 rollup jobs, and for1 of them, I can't see nothing in visualization.
I've got documents in rollup indice (~30M documents)

Below is an example of data

     {
      "_index": "rollup-haproxy",
      "_type": "_doc",
      "_id": "haproxy-rollup$d5vusvm59VE8WiP7QWoFrA",
      "_version": 1,
      "_score": null,
      "_source": {
        "http_verb.keyword.terms.value": null,
        "@timestamp.date_histogram.time_zone": "Europe/Paris",
        "http_verb.keyword.terms._count": 1,
        "@timestamp.date_histogram.timestamp": 1601258400000,
        "time_duration.histogram.value": 675018,
        "time_duration.histogram.interval": 1,
        "@timestamp.date_histogram.interval": "60m",
        "@timestamp.date_histogram._count": 1,
        "time_duration.avg._count": 1,
        "time_duration.value_count.value": 1,
        "time_duration.histogram._count": 1,
        "time_duration.avg.value": 675018,
        "time_duration.sum.value": 675018,
        "http_status_code.terms.value": null,
        "_rollup.version": 2,
        "backend_name.keyword.terms.value": "api",
        "time_duration.terms.value": 675018,
        "backend_name.keyword.terms._count": 1,
        "time_duration.terms._count": 1,
        "http_status_code.terms._count": 1,
        "_rollup.id": "haproxy-rollup"
      },
      "sort": [
        -9223372036854776000
      ]
    }

Fields seems ok; I've compared it with data from another rollup which works, can't see difference except for fields type/name.

Any help would be appreciated.
thanks

2

Can you share the configuration of the job that doesn't work and the request and response of the broken visualization? You can show it by clicking the "Inspect" button in the top right and switching from "Data" to "Requests".

3

Yes,

Here is the rollup job

{
  "config": {
    "id": "haproxy-rollup_v2",
    "index_pattern": "haproxy-*",
    "rollup_index": "rollup-haproxy",
    "cron": "0 0 4 * * ?",
    "groups": {
      "date_histogram": {
        "fixed_interval": "60m",
        "field": "@timestamp",
        "delay": "10m",
        "time_zone": "Europe/Paris"
      },
      "histogram": {
        "interval": 1,
        "fields": [
          "time_duration",
          "srvconn"
        ]
      },
      "terms": {
        "fields": [
          "backend_name.keyword",
          "http_status_code",
          "http_verb.keyword",
          "time_duration"
        ]
      }
    },
    "metrics": [
      {
        "field": "time_duration",
        "metrics": [
          "avg",
          "sum",
          "value_count"
        ]
      },
      {
        "field": "srvconn",
        "metrics": [
          "max",
          "avg"
        ]
      }
    ],
    "timeout": "20s",
    "page_size": 1000
  },
  "status": {
    "job_state": "started",
    "current_position": {
      "@timestamp.date_histogram": 1611194400000,
      "backend_name.keyword.terms": "api",
      "http_status_code.terms": null,
      "http_verb.keyword.terms": null,
      "srvconn.histogram": 11,
      "time_duration.histogram": 4230087,
      "time_duration.terms": 4230087
    },
    "upgraded_doc_id": true
  },
  "stats": {
    "pages_processed": 280,
    "documents_processed": 718870,
    "rollups_indexed": 278736,
    "trigger_count": 1,
    "index_time_in_ms": 65874,
    "index_total": 279,
    "index_failures": 0,
    "search_time_in_ms": 50593,
    "search_total": 280,
    "search_failures": 0,
    "processing_time_in_ms": 5362,
    "processing_total": 280
  }
}

And below is the visualisation

{
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "fixed_interval": "60m",
        "time_zone": "Europe/Paris",
        "min_doc_count": 1
      }
    }
  },
  "size": 0,
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2020-12-22T17:42:03.073Z",
              "lte": "2021-01-21T17:42:03.074Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.