Kibana's "average" aggregation display time is showing the time wrong

I have a pipeline that processes a field, whose value comes in the format "HH:MM:SS", and transforms it into seconds:

ruby {
      code => "
        duration_parts = event.get('format_hh_mm_ss').split(':').map{|str| str.to_i}
        duration_seconds = duration_parts[0]*3600 + duration_parts[1]*60 + duration_parts[2]*60/100
        event.set('duration_in_seconds', duration_seconds)
      "
    }

In "Index Patterns", the "Set format" was set to "Duration". So, when using this field on a Dashboard, with the "Aggregation" of type "Average", sometimes it does not return time values ​​correctly, sometimes it comes with something like "3.75 min"

I tried to reproduce the issue without success. In a 8.10.4 cluster I created some sample data and a data view with a duration field:

PUT issue-344333
{
  "mappings": {
    "properties": {
      "id": { "type": "integer"},
      "ts": { "type": "date"},
      "duration": { "type": "integer"}
    }
  }
}

PUT issue-344333/_bulk
{ "index": {}}
{ "id": 1, "ts": "2023-10-10", "duration": 60}
{ "index": {}}
{ "id": 2, "ts": "2023-10-11", "duration": 60}
{ "index": {}}
{ "id": 3, "ts": "2023-10-12", "duration": 120}
{ "index": {}}
{ "id": 4, "ts": "2023-10-13", "duration": 120}
{ "index": {}}
{ "id": 5, "ts": "2023-10-14", "duration": 180}
{ "index": {}}
{ "id": 6, "ts": "2023-10-15", "duration": 180}


POST kbn:/api/data_views/data_view
{
  "data_view": {
    "title": "issue-344333",
    "timeFieldName": "ts",
    "fieldFormats": {
      "duration": {
        "id": "duration",
        "params": {
          "inputFormat": "seconds",
          "outputFormat": "asSeconds",
          "outputPrecision": 2,
          "includeSpaceWithSuffix": true
        }
      }
    }
  }
}

And a new dashboard showing the average of the duration. Switching between different time frames did not yield a wrong value

Did you find some common pattern to reproduce this issue?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.