Hi,
I’m having an issue with data visualization in Kibana on a time series chart. It appears that documents whose timestamps fall very close to the start of a full minute - e.g., `12:15:00.03` - aren’t always assigned to the expected time bucket.
This manifests as the chart showing, for example, the following for a one-minute interval:
- 3 entries in one minute,
- only 1 entry in the next minute,
- resulting in a visible discontinuity or an uneven distribution of data points on the chart.
For my part, I’ve verified that the documents aren’t being lost:
- logs from all expected interfaces are present in the indexes,
- the issue appears to be solely related to how data is aggregated/mapped to buckets on the chart,
- when logs arrive 100–150 milliseconds after the full minute, the visualization appears correct,
- the problem likely occurs only when an event is collected practically exactly at the minute boundary.
I suspect that recent restarts of services or agents may have shifted the timing of log generation/collection in such a way that events began arriving very close to the bucket boundary. If the difference is a single millisecond, this may be a rare occurrence—estimated at about 1 in 6,000 events for a 10-ms window within a minute.
I’ve already changed one thing in the configuration and want to leave the environment as is until tomorrow to see if the problem goes away.