Null Missing Values in Max Aggregation in Kibana

Elastic Stack Kibana
1

I'm trying to plot a line graph of the maximum value of a Logstash metric over time. Missing values cause the graph to look like this though:

image
image572×517 28.4 KB

I'm trying to use a combination of Advanced options in Kibana to try to get this to display the missing values as zeros.

These include:

  • On the Max Aggregation Metric: {"missing":0}
  • On the Date Histogram Bucket: {"min_doc_count":0}

I can see that adding the latter gives values for the missing timestamps in the Elasticsearch response, but these are allways null. The "missing" parameter doesn't seem to work here? Am I using this incorrectly?

Here is a (simplified) version of the query being generated by Kibana:

{
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "10m",
        "min_doc_count": 0
      },
      "aggs": {
        "1": {
          "max": {
            "field": "my_metric.rate_1m",
            "missing": 0
          }
        }
      }
    }
  },
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "gte": 1547353865741,
              "lte": 1547460733075,
              "format": "epoch_millis"
            }
          }
        }
      ]
    }
  },
  "timeout": "30000ms"
}

And a snippet of the the response:

   {
      "1": {
        "value": 1626.2608642578125
      },
      "key_as_string": "2019-01-13T05:10:00.000Z",
      "key": 1547356200000,
      "doc_count": 480
    },
    {
      "1": {
        "value": 334.3276672363281
      },
      "key_as_string": "2019-01-13T05:20:00.000Z",
      "key": 1547356800000,
      "doc_count": 112
    },
    {
      "1": {
        "value": null
      },
      "key_as_string": "2019-01-13T05:30:00.000Z",
      "key": 1547357400000,
      "doc_count": 0
    },
    {
      "1": {
        "value": null
      },
      "key_as_string": "2019-01-13T05:40:00.000Z",
      "key": 1547358000000,
      "doc_count": 0
    },

Note the null values.

How can I convince Kibana to draw the graph with the missing values as zeros?

Thanks in advance!

2

Hi,

that is currently unfortunately not possible in classical visualizations. Also check this issue: https://github.com/elastic/kibana/issues/17717

You can specify a fitting function if you're using timelion, where the .fit function allows you to specify what should happen for null values.

Cheers,
Tim

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.