Kibana, timelion not visualizing as expected

Elastic Stack Kibana
1

Kibana version: v 7.6.2
Browser: Firefox
OS: Centos7

Hello, I'm facing something estrange working with timelion.

I expect to see all my visualizations like this:

image

The circle can be red, green or yellow and it only has to appear between -9m to now, and it has to be on the line.

The code:

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

.label('promedio 4 semanas')

.color('grey').lines(fill=1),

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter)

.label('diferencia < 15%')

.color('green'),

(

((.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter))

.divide

(

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

))

.subtract (1)

)

.abs()

.if(gt, 0.15, .es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter), null)

.label('diferencia > 15%')

.color('#FFCC11'),

(

((.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter))

.divide

(

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

))

.subtract (1)

)

.abs()

.if(gt, 0.3, .es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter), null)

.label('diferencia > 30%')

.color('red'),

(

((.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter))

.divide

(

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

))

.subtract (1)

)

.abs()

.if(lte, 0.15, .es(q="@timestamp:[now-9m TO now]", q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter), null)

.label('')

.points(10, fill=10)

.color('green'),

(

((.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter))

.divide

(

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

))

.subtract (1)

)

.abs()

.if(gt, 0.15, .es(q="@timestamp:[now-9m TO now]", q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter), null)

.label('')

.points(10, fill=10)

.color('#FFCC11'),

(

((.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter))

.divide

(

(

.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-1w)

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-2w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-3w))

.plus(.es(q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter, offset=-4w))

)

.divide(4)

))

.subtract (1)

)

.abs()

.if(gt, 0.3, .es(q="@timestamp:[now-9m TO now]", q=OutputSMSDefaulter, index=something*, metric=avg:OutputSMSDefaulter), null)

.label('')

.points(10, fill=10)

.color('red')

Time interval between 10m to 20m

But sometimes the circle floats above or under the line, and sometimes I see the circle twice and as far as -1h to now:

Screenshot_2021-02-08 RTDMLab - ESP V2 0 - Kibana(3)
Screenshot_2021-02-08 RTDMLab - ESP V2 0 - Kibana(2)
Screenshot_2021-02-08 RTDMLab - ESP V2 0 - Kibana(1)
Screenshot_2021-02-08 RTDMLab - ESP V2 0 - Kibana

1 Like
2

When you extend the interval to 1 hour or more, does the same graph make?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.