Kibana report dataset is not similar to the discover filtered dataset

Elastic Stack Kibana
1

Hi Friends,
I have a index which i selected in the discover tab as source then i am adding 4-5 filter conditions by which the no of records restricted to less number i.e 64000 but when i save that with a name and share as generate csv then the report is generating with 17000 records and the data is not as per the selected condition. May i know why the data which i selected in the discover is not fetched in the report?

2

hi Tapas,

Can you please add xpack.reporting.csv.maxSizeBytes: 20971520 to kibana.yml and restart Kibana. Value is in bytes. Default is 10485760.

the CSV export creates a single document that is then stored in Elasticsearch, so the maximum is dependent on what Elasticsearch itself can support. There's http.max_content_length setting discussed here that you'l have to keep the xpack.reporting.csv.maxSizeByte under or it'll error out when inserting the document into Elasticsearch.

With that being said, making this value too much larger than the default 10 mB limit is untested and unsupported, and this should be done at your own risk and it has the potential to negatively affect the performance of your Elasticsearch cluster.

Hope it helps,

Thanks
Rashmi

3

Thank You Rashmi!!!
The size of the report increased to 20 mb after adding that line but my actual issue is in the saved objects for example i have selected data set of date and time 13 jul 2020 8 am-9am and save it after that i share it to generate the csv and when i download the report i am getting data of time other times of date 13 jul2020 i mean 10 ,11 am data also present . So i how will restrict that. olease advice.

Reagrds,
Tapas

4

@tsullivan or @joelgriffith can you plz shed some light here/

Thanks
Rashmi

5

Hi, is it possible the time zone of the data is not being formatted correctly? Do you have a time zone set in Advanced Settings? The name of the setting is dateFormat:tz and it should not be set to Browser.

CSV export often depends on having a set time zone because when the data is compiled and formatted on the server-side, it doesn't know what time zone the browser was in. A fix will be coming out for that soon, but in the mean time the workaround is to set the dateFormat:tz setting to a real time zone. If there is not a real time zone set, the data will be formatted as UTC.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.