I have an index which contains data for the last 3 days (Jan 08 - Jan 10). I have a dashboard that shows different things from the index and it seems to only work if my time range is set to 7 days or more. If I set last 24 hours, last hour etc the charts do not show any data.
I have attached the gif that shows this behavior. I am clueless on the cause and require help or suggestions on what could this be.
Hi @sidhusaab,
Could you press the inspect button for the problematic visualizations and post the request and response made here? Additionally the JSON of the exported visualization would be helpful to see what exactly is going wrong.
Hi there,
is it possible that for that TSVB visualization you have the interval setting under Panel Option set to a static value greater than 24h?
If you set it to 3d and then tries to visualize the last 15 minutes you won't see anything.
If that's the case, try setting it to auto or leave it blank.
@flash1293 I am using Timelion type visualization and Inspect button is greyed out for me.
@Fabio-sama Its set to auto in the interval settings.
Interestingly, following along the Fabio's suggestion I set the interval to 10m and it worked for Last 24 hours, Last 30 mins etc now but the graphs aren't as pretty. So for now, I'll stick to setting a static value but would like to know why when interval=auto it does not work.
Oh you are using Timelion. You know, I remember having a very similar problem with timelion some months (and versions) ago (together with a small graphic bug using the dark theme) and that was one of the reasons why I switched to TSVB.
Why not using this last one?
Also because setting such a small interval it'd become impossible to plot a 3-month graph, for computing and ease of reading reasons.
The only reason I am using Timelion vs TSVB is because I have 6 metrics in one graph that I want to monitor and since their values are above zero, it would (IMO) made the graph look messy. So I converted some of the bad metrics into negative values (multiply -1) and they looked better. If I can do something similar in TSVB, I will switch them over.
Ah I didn’t realize these were timelion visualizations. In this case the problem is that the frequency of your data is too low for the auto interval and there are empty buckets between buckets that contain data. In the default setting timelion doesn’t show a chart in this case. You can fix this by using the “fit” function as described here: Displaying sparse data in Timelion using fit() this will interpolate the empty buckets and still show a chart (without having the problem of creating too many buckets with large date ranges)
Ok so I added .fit(none) and changed interval to auto. Back to the same problem.
For context, the data is pulled by http_poller plugin every 10 minutes and I verified that the data is available in the index.
For example: The last 3 hours look like this
Could you try something else than none, e.g. “carry”
Interval set to auto, Time range: last 1 hour, fit(carry) - empty graph.
Could you share your complete timelion script? That will help pin-pointing the problem here. As a side node - moving some series into the negative area of the y axis by multiplying with “-1” should also be possible in tsvb using the “math” aggregation (like here:
Thank you for sticking with me this far. Greatly appreciated.
In this example, I am plotting the 6 record types.
.es(index=bindjson*,timefield='@timestamp', metric=max:qtypes.A).derivative().label("A").lines(fill=2,width=1).color(#03f4fc).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:types.AAAA).derivative().label("AAAA").multiply(-1).lines(fill=2,width=1).color(#b503fc).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:types.CNAME).derivative().label("CNAME").multiply(-1).lines(fill=1,width=1).color(#03dffc).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:types.TXT).derivative().label("TXT").lines(fill=2,width=1).color(#84fc03).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:types.SOA).derivative().label("SOA").lines(fill=3,width=1).color(#fcba03).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:qtypes.SRV).derivative().label("SRV").multiply(-1).lines(fill=2,width=1).color(#03fc9d).fit(carry),
.es(index=bindjson*,timefield='@timestamp', metric=max:types.NS).derivative().label("NS").multiply(-1).lines(fill=1,width=1).color(#dbfc03).fit(carry)So as you are looking into it, I think the problem comes from derivative. If I remove it then I can see the graphs.
Now, why i used derivative is because the source of data keeps counters from start time and does not reset them until the process restarts. So, hence my use of derivative. Am i using that incorrectly or is there an alternative to derivative? Basically what I want to see is the delta since the last time. It will either be '0' or a positive number unless the process restarts and resets the counters to zero.
You are right, derivative is causing your problem. This is the underlying code:
eachSeries.data = _.map(pairs, function(point, i) {
if (i === 0 || pairs[i - 1][1] == null || point[1] == null) {
return [point[0], null];
}
return [point[0], point[1] - pairs[i - 1][1]];
});
It will output the difference to the data point before the current data point, but won't skip null values.
Could you try applying fit before derivative? Then it should fill in the missing values before calculating the derivative, which should give you the derivative of the existing values. In this case fit(none) should be the right choice because it basically just gets rid of the null data points in between.
.es(index=bindjson*,timefield='@timestamp', metric=max:qtypes.A).fit(none).derivative().label("A").lines(fill=2,width=1).color(#03f4fc),
That did it!
The graphs work now. I will work on cleaning/formatting them a little but overall works for what I need.
Awesome and thank you for your help. 
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.
