I am using kibana-4.3.1and logstash-2.1.1-1 version
When I plot the Line chart graph I see all the data points were considered for plotting the graph.
However, If I add SPlit Lines > Significant Term filter, I see some of the data were not considered for plotting the graph.
To confirm data issue, I used Data Table with similar filtering ( Split Rows > Significant Term filter), but there I am able to see all the data points.
Can you please help finding a solution for this issue?
Probably because the significant terms algorithm didn't find anything.
I don't know the exact details of how it works but I am not surprised, you aren't likely to find significant terms everywhere, that is the point of it.
Doing a significant terms aggregation with a Data Table and one with a Line chart in the way you've done it are actually two different queries. In the line chart example, you first do a date histogram aggregation and then a significant terms aggregation while in the Data Table you are only doing a significant terms aggregation.
If I were to perform a similar query as your line chart (show below),
and do the same for the Data Table (shown below),
you can see that I get the same results. Its made more apparent by examining the data table in the spy panel.
By clicking on the ^ symbol, you can open the spy panel and see the results in a table format. You can also examine the query sent to elasticsearch and the elasticsearch response in the other tabs.
Thanks Shelby, looks like I was totally off