my question deals with processing of time series data using the sibling pipeline aggregation, e.g. for creating a line chart.
As first aggregation, I need to sum up buckets of different time series. The bucket size should always be defined by the original temporal interval (in my case 5 minutes for all time series). As second aggregation, I need to find the maximum value of an bucket.
If the bucket size equals 5 minutes, e.g. for a line chart with date histogram, the result is straightforward. If I need to zoom out, e.g. last 24 hours or last 7 days, the interval of the line chart changes to e.g. 30 minutes or 3 hours. What I need to get as a result for these intervals is the maximum value of the original 5 minute buckets within the broader 30 minutes or 3 hours buckets.
Instead, a summed value refering to 10 minutes or 1 hour is shown. The request also shows that the intended 5 minute buckets are not queried but instead a broader interval of 10 minutes or 1 hour. In order to depict this, I have added 2 screenshots covering the case for the last 7 days.
My questions are:
- Why is the interval automatically changed from 5 minutes to 1 hour if for example the last 7 days are shown?
- Is there a way to force Kibana to stick to the original interval selection made in the sibling pipeline aggregation?
- Why is there a hint/warning like "This interval creates too many buckets to show in the selected time range, so it has been scaled to hour" in Kibana version 6.2.4 but not in Kibana version 6.4.2? I have not yet checked the behavior for Kibana version 6.5.0.
Many thanks in advance.