Line graph visualization bug?

[Fran_Fabrizio]

So, I managed to create this beauty...

(Sorry I cut off the legend - the individual lines are for different years - explained below).

I have documents with field user_id and then I have scripted fields year and month_of_year which are calculated off of @timestamp.

I defined a line graph where I first did a split lines on term year and then a sub-bucket x-axis on term month_of_year. In both cases I ordered by Term Ascending (with 6 for the year, since my data is 2011-2016, and 12 for the month_of_year). The y-axis is unique count of user_id.

As you can see, something is goofy. Specifically, it seems to have had trouble sorting month_of_year in ascending order. Is this a bug, or did I just configure something incorrectly?

FYI, my goal for this graph is to have a line for each year showing number of unique users by month - for easy year-over-year comparison.

[shaunak (Shaunak Kashyap)]

Hi, can you share the following information please?

• Versions of Kibana and Elasticsearch.
• Definitions of the year and month_of_yearscripted fields. Specifically, what you've entered into the Script text box when creating each scripted field.
• The response from Elasticsearch for this visualization. To get this, open the visualization on the Visualize page, then click the little ^ button below the chart. This will pop open what is called the spy panel. In the spy panel, click the Response button. This will show the Elasticsearch response for this visualization.

[Fran_Fabrizio]

Sure, sorry I omitted that previously. Kibana 4.4.2, Elasticsearch 2.2.0.

year is defined as doc['@timestamp'].getYear()
month_of_year is defined as doc['@timestamp'].getMonth()

The response exceeds the forum's character limit, but can be viewed here: https://www.dropbox.com/s/6paqrl41ymr9lew/elasticsearch-response.txt?dl=0

[Fran_Fabrizio]

Update: same behavior observed after upgrading to ES 2.3.2 and Kibana 4.5.

[shaunak (Shaunak Kashyap)]

Hi,

I was able to reproduce this. You simply need to reorder the aggregations to fix this

So currently you are seeing something like this (the thing to note is that the Split Lines by year aggregation is happening before the X-Axis by month_of_year aggregation) :

Just click the little "Increase Priority" arrow next to the X-Axis by month_of_year aggregation:

Then, if you re-render the visualization, you should get the right ordering of the months on the X axis:

[Fran_Fabrizio]

Thanks, that does solve this problem. Unfortunately, it leads me to
another problem, where my data values were changing unexpectedly when I add
buckets, which I describe in a separate post here:

Confused about interaction between unique count and buckets

Let's say I set my time range to be 2013-01-01 00:00:00.000 to 2013-01-31 23:59:59.999 (entire month of January 2013). Then I do a line graph visualization and keep the default y-axis setup which is a count of _all documents in my index in that time range, it produces 1,565 hits. (just a dot at 1,565, since I haven't defined an x-axis). One of the fields in my documents is user_id. If I then change the y-axis to do a Count of user_id in that same time period, I get 1,565 hits. So far, nothi…

Thanks again. I'm glad that reordering the buckets solved the graphing
bug, at least!