Struggling to get Top-Hits Visualization to work

I did understand that Top-Hits always shows the latest value. In my visualization it jumps from Zero Values to real values every 2-3 refreshs, and i cannot figure out why.


Here is the setting:

Running Elastic and Metricbeat on V 6.4.2

nobody a clue?

Some more information. As you can see, metricbeat sends the info:


and here's the visualiation. Settings are in the screenshot above:

You can at first check to see if the refresh set on your dashboard is > the shipping interval for disk statistics in Metricbeat.

Shipping Interval: 30s ( presume, since metrics.period isn't set)
Refresh Interval: 30s

Output:


So, no. This doesn't solve it. Tried a few different servers aswell.

Can you show how the visualization is built? Maybe we can achieve something similar to this using a different metric/aggregation.

Actually, i have the exact same problem with the Gauge i am using as an overview. Here are the settings for it:

and here are the metrics related to it:

you might be hitting some of the device_names that have no free space reported for. Could you try and recreate the same thing in the normal Data Table instead of the TSVB Data Table?
I tried something like that and there are devices for which there is Data and there are a lot that don't have any data, like /dev/loopX.

No Marius, please check the first post i made.
The visualization jumps from 0 values to the correct values every 1-3 refreshs.
My original question was: Shouldn't the Top-Hit always be the highest amount reported, thus never resulting in a zero value if there has been a non-zero value reported in the given timerange.

it shows the top hit in that bucket, not overall, so that it's why it will show 0 for some of them when you don't have any events for that drive_name in the interval of the bucket.

ok, i try with a normal data table. Let's see if this works.
Thanks for your guidance though :slight_smile:

That works perfect, thanks Marius!

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.