Filter Ratio not displaying data

[franco-martin]

Hi, im indexing some data and I want to know the ratio of documents that have isCompliant as True. I visualized the data as count over time and I see documents.

Then I moved to gauge and applied the filter as grouping

But when I try to use filter ratio with the same filter as numerator, it stays at 0. Even when I choose * as numerator and denominator it stays at 0. (Shouldnt it be 1?)

[wylie (Wylie Conlon)]

Unless you set the "Time range mode" in TSVB to "entire time range", you will only see the last time interval in gauges. Since your visualization says the interval is 10 minutes, you will only see the last 10 minutes in the gauge.

[franco-martin]

It is set to entire time range. WHat you see as 10 minutes is the time aggregation

[wylie (Wylie Conlon)]

Okay. It is important to note that Filter Ratio does not use KQL syntax, it uses Lucene syntax. They are similar but not identical. If your field is a boolean, then you need to use isCompliant: true instead of isCompliant: True.

If that doesn't solve the issue, then it would be helpful to see an example document that you are trying to match against.

[franco-martin]

The field is not boolean, it has three possible values for now. True, False and nopipeline. I tried the same query with a boolean field and the query syntax as suggested but it is still not working.

Here are the values that field can take

Finally, here is a sample document.

"@timestamp": "2020-07-16T03:25:35.254747",
"tags-key-value": {},
"languages": {},
"isCompliant": "nopipeline"

[wylie (Wylie Conlon)]

Got it. Then this should be working. Are you sure you've enabled "Entire time range mode" in TSVB? It wasn't in any of the screenshots.

[franco-martin]

Yeah, here you go

[franco-martin]

I updated kibana from opendistro 1.8 to 1.9 and it didnt fix it. What I did was remove the wildcards.