Last value of syste.uptime.duration.ms

[ratseba (Seba)]

Hi,
I need show on dashboard uptime for server. I tried do this by Lens -> Metric. When i set for metric: Last value od system.uptime.duration.ms and sort by @timestamp then i dont see anything. In index i have this data, i can see this in Discovery modul. When i switch in metric from 'Last value' to Mediana then data was showed. Why i cant see this when i have choosen Last value ?
Discover module show this data:

But in metric-> last value i cant see this

When metric change from last_value to mediana i see value. Why ?

[ghudgins (Graham Hudgins)]

it's likely because you have a different metricbeat dataset coming through for the last timestamp in your data. metricbeat* is an umbrella of various datasets (defined in the event.dataset field or even in the index / data stream naming convention themselves). it just so happens the "last value" came from some other dataset so this metric is null. two solutions: 1) use a data view (formerly called index pattern) for just the system event.datasource or, for a very easy option, 2) filter your lens metric to exist so you remove nulls from other datasets. in the lens metric click "advanced options" and "filter by" and enter system.update.duration.ms : * as your kql for this sort of "exists" filter--you can also do this at the query bar level too.

I agree this is hard to figure out on your own and hope we can filter like this by default in lens as I believe this is what most people expect with a name like "last value" [Lens] Filter last value fields by default · Issue #113140 · elastic/kibana · GitHub

the median exists because it doesn't take null into account since it's an aggregation. for some people last value is meaningful if it's blank so this is why this is an overall possibility.

[ratseba (Seba)]

Thank you, works fine now