Strange output in Time Series Visual Builder

Elastic Stack Kibana
1

I'm trying to use TSVB to show a list of the most common alerts in my system. If I do a search in Discovery, I get three documents with my settings.

Discovery view with three docs

If I use Top N and do a Count Aggregation with a term grouping, I get all documents from the index within the selected time frame.

Top N settings

But I need to do some filtering to show just the alerts and not all status messages etc in the index. Therefore, I used Panel Filter _type:elastalert to filer out the unwanted, just like in the Discovery tab.
But with the filtering, I only get a count of 1, even though it should be 3. Why?

Panel Filter settings

If I look at the documents, they are identical, except for ID's and timestamps.

2

It's showing the last bucket and not the count for the entire time period. You would need to add an "overall sum" to see all three.

3

Thank you, that did it!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.