In pie chart, "info" is lost:
when I remove line char, "info" is show in pie chart:
Whoa that is pretty weird!
Just to make sure you have no hidden filters (there have been bugs about filters applied to a dashboard that don't show up in the title bar) - what happens if you add those same two visualizations on a brand new dashboard? If you add the pie chart first, do you get all results? Then if you add the second line chart, is the pie chart filtered again?
I crate new dashboard, add pie chart first:
then add line chart:
It's fine, but when I click the query button, "ERROR" is disappear in pie chart:
Wow that is a strange one.
What version of kibana are you on?
Can you export those two visualizations and post the json?
Thanks for quickly reply, I use kibana 6.2.3.
[
{
"_id": "11274c70-3cb7-11e8-a9e2-e54c94e0051f",
"_type": "visualization",
"_source": {
"title": "sendinfo-web-level-pie",
"visState": "{\"title\":\"sendinfo-web-level-pie\",\"type\":\"pie\",\"params\":{\"type\":\"pie\",\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"isDonut\":false,\"labels\":{\"show\":false,\"values\":true,\"last_level\":true,\"truncate\":100}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"significant_terms\",\"schema\":\"segment\",\"params\":{\"field\":\"level.keyword\",\"size\":5}}]}",
"uiStateJSON": "{}",
"description": "",
"savedSearchId": "14be73e0-341a-11e8-b946-6d2aa77a3448",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"lucene\",\"query\":\"\"}}"
}
}
},
{
"_id": "e74200d0-3cc0-11e8-a9e2-e54c94e0051f",
"_type": "visualization",
"_source": {
"title": "sendinfo-web-level-count-line",
"visState": "{\"title\":\"sendinfo-web-level-count-line\",\"type\":\"line\",\"params\":{\"type\":\"line\",\"grid\":{\"categoryLines\":false,\"style\":{\"color\":\"#eee\"}},\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"type\":\"category\",\"position\":\"bottom\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\"},\"labels\":{\"show\":true,\"truncate\":100},\"title\":{}}],\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"name\":\"LeftAxis-1\",\"type\":\"value\",\"position\":\"left\",\"show\":true,\"style\":{},\"scale\":{\"type\":\"linear\",\"mode\":\"normal\"},\"labels\":{\"show\":true,\"rotate\":0,\"filter\":false,\"truncate\":100},\"title\":{\"text\":\"Count\"}}],\"seriesParams\":[{\"show\":\"true\",\"type\":\"line\",\"mode\":\"normal\",\"data\":{\"label\":\"Count\",\"id\":\"1\"},\"valueAxis\":\"ValueAxis-1\",\"drawLinesBetweenPoints\":true,\"showCircles\":true}],\"addTooltip\":true,\"addLegend\":true,\"legendPosition\":\"right\",\"times\":[],\"addTimeMarker\":false},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}},{\"id\":\"2\",\"enabled\":true,\"type\":\"date_histogram\",\"schema\":\"segment\",\"params\":{\"field\":\"@timestamp\",\"interval\":\"auto\",\"customInterval\":\"2h\",\"min_doc_count\":1,\"extended_bounds\":{}}},{\"id\":\"3\",\"enabled\":true,\"type\":\"significant_terms\",\"schema\":\"group\",\"params\":{\"field\":\"level.keyword\",\"size\":5}}]}",
"uiStateJSON": "{}",
"description": "",
"savedSearchId": "14be73e0-341a-11e8-b946-6d2aa77a3448",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"filter\":[],\"query\":{\"query\":\"\",\"language\":\"lucene\"}}"
}
}
}
]
Can you also export and post the json for your saved search those two visualizations are both linked to? So far, I don't see anything strange, and can't repro.
One more thing, just to make sure it's related to the line chart being on a dashboard. If you add only the pie chart to a dashboard and click the query button, does ERROR disappear?
saved search export:
[
{
"_id": "14be73e0-341a-11e8-b946-6d2aa77a3448",
"_type": "search",
"_source": {
"title": "sendinfo-web-save-search",
"description": "",
"hits": 0,
"columns": [
"hostname",
"requestId",
"level",
"module",
"message"
],
"sort": [
"@timestamp",
"desc"
],
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{\"index\":\"fcc5eda0-3409-11e8-b946-6d2aa77a3448\",\"highlightAll\":true,\"version\":true,\"query\":{\"language\":\"lucene\",\"query\":\"\"},\"filter\":[]}"
}
}
}
]
If add only the pie chart to a dashboard and click the query button, ERROR doesn't disappear.
Strange, nothing obvious stands out that could cause an issue.
Can you send the network requests going to elasticsearch? If you open dev tools in chrome, and go to the network tab, you should be able to find them. I'm looking for the Request payload on all the _msearch calls that show up after you press the query button.
I encounter another strange problem about pie chart:
request body:
{"index":["sendinfo-web-*"],"ignore_unavailable":true,"preference":1523719935234}
{"size":0,"aggs":{"2":{"significant_terms":{"field":"level.keyword","size":5}}},"version":true,"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}},{"match_all":{}},{"range":{"@timestamp":{"gte":1524141407092,"lte":1524227807092,"format":"epoch_millis"}}}],"filter":[],"should":[],"must_not":[]}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"fragment_size":2147483647}}
INFO is lost, just show ERROR, when I filter out ERROR, INFO is show:
request body:
{"index":["sendinfo-web-*"],"ignore_unavailable":true,"preference":1523719935234}
{"size":0,"aggs":{"2":{"significant_terms":{"field":"level.keyword","size":5}}},"version":true,"_source":{"excludes":[]},"stored_fields":["*"],"script_fields":{},"docvalue_fields":["@timestamp"],"query":{"bool":{"must":[{"match_all":{}},{"match_all":{}},{"range":{"@timestamp":{"gte":1524141445449,"lte":1524227845449,"format":"epoch_millis"}}}],"filter":[],"should":[],"must_not":[{"match_phrase":{"level.keyword":{"query":"ERROR"}}}]}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"fragment_size":2147483647}}
Last 24 hours data show in line chart:
Ahhh, I think this might be because you are using significant terms and not a regular terms agg. It determines what is significant based on your filters, hence the change. If you change it to a regular terms agg instead of significant terms, does everything work as expected?
I change it to regular terms agg, and it work as expected. Thanks!
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.