[ELK 7.3.0] Visual Builder Gauge not visualizing data if different timespan

#1

Hi there!

I'm having some problems with the Visual Builder Gauge visualization.

I have all the data on some given indices (say test_1, test_2, test_3, test_4) between the 2019/07/10 and 2019/07/20.

I wanted to make a percentage of the error events over the total (log_level: ERROR / log_level: *) and I'm using the filter ratio agg of the VB Gauge, as I successfully did in the past.

Now, couple of problems:

  1. Differently from the past, if I use a parent/sibling aggregation after the Filter Ratio (like the Overall Average, which was necessary to get the right estimate in past releases), it shows me "No data to visualize".

  2. If I only keep the Filter Ratio agg with the Count metric, it returns the right estimate only if I set a very large timespan, like 6 years ago-now, even if the data are only present withn the above-mentioned timerange.

Before you ask, I only have one temporal field (@timestamp edited in Logstash and recognized as correct time field by the index pattern).

Is it a bug of the 7.3 release? Otherwise, what can cause this strange behavior?

Thank you all!

#2

In case they might help, I'll post some screenshots.

As you can see from these first two screens, I only have data (for that specific index pattern) between 2019-07-10 and 2019-07-20. In fact, setting the from parameter equal to ~7 years ago didn't change the number of docs.

discover_limited_timerange
discover_limited_timerange.png1844×487 49 KB
discover_wide_timerange
discover_wide_timerange.png1853×527 44.3 KB

Now, moving to the Visual Builder Gauge visualization, I set these preferences in the Panel Options (index pattern is obviously the same of the one used in the Discovery section):

vb_panel_options
vb_panel_options.png1851×747 41.9 KB
.

In the Data section, as you can see from the following pics, first, I do not need any sibling or parent aggregation to get some results. On the contrary, if I try and put one (as I used to do in 6.6.1 for example) it even tells me No data to display for the selected metrics.

Though, if I remove the sibling aggregation, I can only see the right percentage setting an incredibly wide timespan (~7 years, not even ~1 year), which doesn't make sense since I only have data within a very restricted timerange.

no_data_to_display
no_data_to_display.png1853×849 49.3 KB
vb_data_short_timerange
vb_data_short_timerange.png1853×836 49.8 KB
vb_data_wide_timerange
vb_data_wide_timerange.png1859×837 50.3 KB

I can think nothing but a bug, but maybe something changed in 7.3 and I don't know and I'm simply skipping some passages.

Ideas?

#3

Yes, Overall Overage is broken in 7.3.0- not sure what version you upgraded from, but the bug was only caught recently and is backported for the 7.3.1 release: https://github.com/elastic/kibana/pull/42074

#4

Ok, so I wasn't wrong.

Last time I used the Overall Average was in 6.6.1 and it kinda worked.
Now the overall average doesn't work, but it looks like a problem of the Visual Builder in general to me. Since it's not normal I can see the right value by increasing the timerange where there are no data, regardless of the Overall Average.

Thank you anyway.