Kibana: getting wrong data with offset -1w?

asp · April 24, 2017, 6:33am

Hi,

I've got a problem with kibana's timelion.

I am comparing the count of today and last week using offset functionality.

This picture I got, when running for today:

This picture I get, if I set the time picker - 1 week, so that the shart is showing -1w and -2w.

I expected to see red line of above chart (last week from time picker today) to be identical with mint line of bottom chart (time picker last week).

But I found one chart has values starting at 2k and the other of 3k.
Is that a timelion bug or what did I make wrong?

Here is the query:

.es(index="tux-*",q="type: useractionlog AND stage: Production").label("count now").lines(width=2),
.es(index="tux-*",q="type: useractionlog AND stage: Production", offset=-1w).label("count offset -1week").lines(width=2)

Thanks Andreas

spalger · April 24, 2017, 10:39pm

Weird, but the shape of the lines seems to match. Can you try hovering over different points on both charts and recording some of the values? Maybe it's just drawing weird...

asp · April 25, 2017, 8:50am

It is getting even more weird.

I cannot reproduce the problem any longer. Now it is fine, graph and values in legend.

May it be, that timelion was just not throwing an exception if not all shards could be read?

spalger · April 25, 2017, 2:56pm

That's entirely possible. That would account for why the shape was generally the same, but the number was off...

Looks like timelion only complains if no shards were reached

github.com

elastic/kibana/blob/master/src/core_plugins/timelion/server/series_functions/es/index.js#L66-L72


  search: `"${config.index}"`,
  search_fields: ['title']
});
const indexPatternSavedObject = findResp.saved_objects.find(savedObject => {
  return savedObject.attributes.title === config.index;
});
let scriptedFields = [];

system · May 23, 2017, 3:00pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.