I am creating to 2 graph, from two different graph type, tsvb and graph. Both datasets using same filter and aggregation but i realize that there is a noticeable gap between both graph. See image attached. Top graph shows 4.2mb while graph from lens shows 3.9mb.
Anyone has idea where and how should i start to investigate this?
what type of aggregation are you using on both?
Also, what version of the stack are you using?
Both using average as aggregation.
As for the version, I am using v 8.4.3.
Can you open the Inspect panel for both and compare the two requests sent over?
Is there any particular difference? Can you paste here (redacted of field names and/or other sensitive info)?
Hi @sixsenseninja
I have seen this before and for me it's been a combination of two things typically.
One if you're moving between two different visualizations and you're doing something like the last 15 minutes which is really translated in from now to 15 minutes ago ... The now is not the same, which means the actual date histogram buckets may not be exactly the same which then means the average over those date histogram buckets is not the same.
The second reason I see this sometimes is lens and TSVB are actually picking different date histogram bucket sizes which then can affect the average.
In order to properly test you have to use exact / absolute time frames and ensure that the date histogram buckets are exactly the same, 30 seconds, 1 minute, etc.
If you do that and then the data is still different that would be interesting. But I found once I do all that the data tends to be the same.
hi guys, thank you for some of the insight on this topic. I may found the answer below. However, maybe I need some validation from you guys to confirm the finding. It seems both tsvb and lens take different approach when performing the average?
Good research I actually think there is something else going on... and I am sure we could get TSVB and Lens to do the same... but lets focus on what you really want.
The actual question IS what does that value represent in terms of type is it in fact Bytes (perhaps but we don't know because it is redacted, for this exercise I will assume it is) then we should show Rates in Bytes and What do you Want to Show on your Graph.
(BTW with network rates you should always double check that is is in fact Bytes not Bits but that is another discussion, again I will assume it is actually Bytes)
The first thing is if this a Custom Metric, the first think I would do is go to the Data View and set The formatter as Bytes if you want ... you can leave it a Raw number but if you set the formatted anywhere you use it it will automatically be formatted as human readable Bytes.
Stack Management -> Data Views -> Your Data View -> Your Field
In this case I am using a field that is bytes I sett the formatter to bytes with 2 decimal Places.
Now When I create a Lens ... You can choose the format
Default will use what the Field Formatter is set to... In this Case Byte
Or I can still say use it as a Raw Number
Or IF you did not set the Default Formatter in the Data View I could still set the format in each Lens..
Try it ... See what you think... I suspect in your TSVB vs Lens one was using bytes... the other wasn't
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
