Data Table Time Offset

Elastic Stack Kibana
1

I have been building a dashboard with a couple of indexes. After evaluation, it turns out one of the indexes seems to be off by 1hr. For all of my timelion visualizations, this was corrected by modifying each reference to this index with an offset=-1h.

However I have a data table visualization which I would like to modify with this as well. I have added this attribute to the JSON and while it seems to pass the syntax check, it doesn't seem to apply. Is this possible and, if so, any thoughts on where it should go?

{
  "title": "Client Copy",
  "type": "table",
  "aggs": [
    {
      "id": "1",
      "enabled": true,
      "type": "avg",
      "params": {
        "field": "usage",
        "customLabel": "Average Usage"
      },
      "schema": "metric"
    },
    {
      "id": "2",
      "enabled": true,
      "type": "terms",
      "params": {
        "field": "Meter",
        "orderBy": "1",
        "order": "desc",
        "size": 25,
        "otherBucket": true,
        "otherBucketLabel": "Other",
        "missingBucket": false,
        "missingBucketLabel": "Missing",
        "customLabel": "Meter"
      },
      "schema": "bucket"
    },
    {
      "id": "3",
      "enabled": true,
      "type": "sum",
      "params": {
        "field": "usage",
        "customLabel": "Sum of Usage"
      },
      "schema": "metric"
    },
    {
      "id": "4",
      "enabled": true,
      "type": "std_dev",
      "params": {
        "field": "HrVal",
        "customLabel": "Standard Deviation"
      },
      "schema": "metric"
    },
    {
      "id": "5",
      "enabled": true,
      "type": "max",
      "params": {
        "field": "usage",
        "customLabel": "Max Reading"
      },
      "schema": "metric"
    }
  ],
  "params": {
    "perPage": 10,
    "showPartialRows": false,
    "showMetricsAtAllLevels": false,
    "sort": {
      "columnIndex": null,
      "direction": null
    },
    "showTotal": false,
    "totalFunc": "sum",
    "percentageCol": "",
    "offset": "-1h"
  }
}
2

The best solution is to make sure your data is correct before visualizing. I work on the Kibana visualization tools, and there is no way to get the correct data using the table visualization that you're using- but it is possible using timelion or vega. It is also possible to get a close approximation using TSVB, but you will lose an hour of data.

These are the options that I considered before telling you that this requires a different tool:

  1. If you were using a date histogram inside your chart, you could use the advanced JSON to set offset: -1h inside the date histogram. However, you would lose an hour of data because of the time filter restricting what's visible.
  2. The TSVB editor also supports an offset, but you will also lose an hour of data because of the time filter.
  3. You can't use a Kibana scripted field because the time filter can't be based on a scripted field

In the medium term we are planning on adding better support for time offsets into all the visualization builders, but it's not ready yet.

3

I totally agree. I think we will work on future ingestions in order to address this at the source level in the future.

Thank you for the info, I really appreciate it! I've been meaning to get into the Vega visualizations but just haven't had the time yet...so much to learn, so little time lol.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.