Problem with Vega Kibana 6.2


(Emil Mirzayev) #1

Hi there. I just started using VegaLite in Vega plugin in Kibana. However, I get an empty result instead of vizualisation. I am using "logstash-*" created by Makelogs. I want to have daily log counts in a line graph. Inserting VegaLite query below:

{
  "$schema": "https://vega.github.io/schema/vega-lite/v2.json",
  "data": {
    "url": {
      "index": "logstash-*",
      "body": {
        "size": 0,
        "aggs": {
          "days": {
            "date_histogram": {
              "field": "@timestamp",
              "interval": "day"
            }
          }
        }
      }
    },
    "format": {"properties": "aggregations.days.buckets"}
  },
  "transform": [{"calculate": "toDate(datum.key)", "as": "date"}],
  "mark": "line",
  "encoding": {
    "x": {"field": "date", "type": "temporal"},
    "y": {"field": "doc_count", "type": "quantitative"}
  }
}

Am I doing something wrong? Probably I am, would be grateful for any help


(Emil Mirzayev) #2

This is the response I am getting. It draws the axes, but graph is empty


(Yuri Astrakhan) #3

Emil, you mistyped property as properties. In order to discover this, I used browser's developer console (F12 on Windows), and tried to examine the data source. Vega-Lite automatically creates one called source_0:

VEGA_DEBUG.view.data('source_0')

For some reason, I only saw a single row of data, and that data did not contain the expected fields, so I looked at the property to see if it was extracting the right sub-field from the request, and noticed it there.

In general, you can verify that data is returning correctly either by trying the request in the Kibana Dev Tools tab, or via the browser's developer tools - network tab (browser will make _search requests to the server, and you can examine the data).


(Emil Mirzayev) #4

Thank you Yuri,

it solved my problem. As I understood, in order to ease debugging, one should name variables.

I also found your tutorials. Looking forward seeing the new ones!


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.