No data in simple vega lite visualization

Elastic Stack Kibana
1

Hello, I've been using elastic search/kibana for a couple of months, but I'm very new to vega visualization.
I have a simple script like this :

  {
      $schema: https://vega.github.io/schema/vega-lite/v2.json
      title: Event counts from all indexes
      data: {
    url: {
      %context%: true
      %timefield%: @timestamp
      index: fiabdata*
      body: {
        aggs: {
          matricules: {
            terms: {field: "Matricule.raw"}
          }
        }
        size: 0
      }
    }
    format: {property: "aggregations.matricules.buckets"}
      }
      mark: bar
      encoding: {
    x: {
      field: key
      type: ordinal
      axis: {title: "Matricule"}
    }
    y: {
      field: doc_count
      type: quantitative
      axis: {title: "Document count"}
    }
      }
    }

The response of the aggregation :

   '"aggregations" : {
       "matricules" : {
         "doc_count_error_upper_bound" : 522,
         "sum_other_doc_count" : 1374702,
         "buckets" : [
           {
             "key" : "90156811",
             "doc_count" : 2918
           },
           {
             "key" : "90010636",
             "doc_count" : 597
           },
           {
             "key" : "90085981",
             "doc_count" : 585
           },
           {
             "key" : "88219052",
             "doc_count" : 549
           },

The problem I have is the graph don't display anything :

vegagraph2
vegagraph21919×947 58.4 KB

I have data in the time range I selected.
I'm on kibana 7.5.0
Am I missing something ?
Thanks for your help.

2

Hi @zonas27,

I just gave your example a try and it works well on one of sample kibana datasets.

My only guess is:
The response of the aggregation you've attached: did you get from browser's dev tools network tab from the request fired by Vega visualization? Or did you get separately, let's say, from Kibana's dev tools when testing the aggregation?

I am thinking if maybe

%timefield%: @timestamp

is incorrect for your index and it should be something else and not @timestamp.

2 Likes
3

If the suggestion of @dosant doesn't work, please follow the steps outlined in https://gist.github.com/nyurik/736c34970ba3c32f3fe3d45d66719b3e and post the result here. This will help with further debugging.

2 Likes
4

Thanks for your answer. I got the response I displayed by kibana Dev tool.
I've commented %timefield% and it worked !
As I understood I must put in %timefield% the date field I use for the chronology of my documents ?
In my case it's named "Measure date" in the documents, the graph worked when I used it.

Thanks for the tip @flash1293 it certainly will be useful in the future.

5

As I understood I must put in %timefield% the date field I use for the chronology of my documents ?

Yes, exactly.
just instead of @timestamp try your field name.

%timefield%: mytimefield
1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.