Help with Lens Bar (only show values)

[erikg]

Hello All,

I was creating a visualization of process metrics using Elastic Agent System Integration. This is collecting top processes by CPU.

I am wondering how do I show only data, if you see some values appear but theres no data

[stephenb (Stephen Brown)]

Hi @erikg

I am having trouble parsing this sentence

@erikg

I am wondering how do I show only data, if you see some values appear but theres no data

Can you provide examples

I am not sure how to

Only show data... But theres no data

[erikg]

Haha my bad @stephenb

I basically am trying to say, if the current visual suggests certain process names have no data (no bar shown), then I would only prefer seeing process names with data, making the visualization look cleaner.

Hopefully that makes more sense?

[stephenb (Stephen Brown)]

try process.name : * or process.name :* and system.process.cpu.total.norm.pct:*

[stephenb (Stephen Brown)]

@stephenb

process.name :* and system.process.cpu.total.norm.pct:*

Huh that did not work when I said top 20 and there was say only 10 reporting.. will need to take a look later... not sure why that is not working

What version are you on

[Tortoise]

Hello @erikg

As requested by Stephen please share the ELK version?

It seems that when you filter using : * we get records which has value as 0% which is valid & they are not null so those process we can see on the chart , example of 1 process , in your case http :

I am not sure if we can use below work around :

before :

after :

system.process.cpu.total.norm.pct > 0

Thanks!!

[stephenb (Stephen Brown)]

@Tortoise @erikg

Interesting... Yup I see the same thing in Lens

system.process.cpu.total.norm.pct : * or system.process.cpu.total.norm.pct >0 in the Top / Overall KQL bar at the top filter it worked but weirdly in the filter in the Metric it does not work... I believe because THAT fillter happens After the Aggregation.

So the lesson is filter in the KQL bar in Lens to reduce the data set
Actually this ^^^ is a really important way to make your lenses better...

This works in ESQL

FROM metrics-*
| WHERE process.name IS NOT NULL and system.process.cpu.total.norm.pct IS NOT NULL
| STATS avg_cpu = AVG(system.process.cpu.total.norm.pct) by process.name 
| SORT avg_cpu DESC