Table Visualisation Failure After Adding a Property

[AClerk]

Hey All,
I have created a table visualisation.
Metric is - Max (Timestamp)
Then I split rows according to properties available in the doc.
All works fine until I change the filter to show time that is more than the last 10 hours (e.g. last 12 hours)
Then I get "Shards Fail" error and the table is blank.
I found that at least 1 field is problematic. When I remove it, the table works as expected.

What is wrong?
How Can I debug this issue?

Cheers!

Screenshot -->

[Zany]

Can you try reducing the duration (e.g. 2 hours)?

I found that at least 1 field is problematic. When I remove it, the table works as expected.

Which field is this?

[AClerk]

@Zany
The problematic field is the one marked in red.

When I use 15 minutes duration, the table works as expected.
As I wrote in the previous post

All works fine until I change the filter to show time that is more than the last 10 hours (e.g. last 12 hours)

But that's not consistent. The data disappears with 2 hours or 1 hour from time to time.
For example, this is for 2 hours duration

The question is, how can I debug this issue?
Seems like the long durations filter causes some kind of data conflict that the visualisation cannot handle.
Cheers!

[Zany]

It seems like this is related to the "Shards Fail" error.

You can refer to this thread, How to Increase number of shards of an existing Index, to optimize the shards in your index.

[AClerk]

Hi @Zany
Thanks for the reply.
I do not understand how this is relevant. And I'll explain.

• I am using the same index with many other dashboards and visualisations, and am not getting this issue.
• The index is time-based. So, every week a new index is created.
• I have dozens of more indices and don't have that problem.
• I have 5 nodes with 1000 shards on each one. Currently, using less than 4000 shards in total.

Can you please elaborate on why you think the root cause is lack of shards?

Thanks a lot!