I am somewhat new to Timelion but can't seem to figure out what I am missing that my usage of the sum metric is returning all 0s, when the count seems to work fine.
I have this query:
Which returns a graph as expected
However I just make a simple change in the metric from count to sum and it only returns 0s.
I know there are some null values for jobInfo.FWVideo.cpuCount in my data, but I would assume some graph would appear and the intervals that have only null might default to 0 or some value, but i don't expect 0 to be returned for all ranges that have a mix of null and not null values.
Any ideas to try?
EDIT: Forgot to add, I am on Kibana 5.4
count actually ignores the field value behind it, because it just counts documents. I think the most likely issue here is, that there is a typo in the field name. Are you sure there is a field, written exactly that way (case sensitive) in your index?
Ah I didn't know count was ignoring everything after the colon, that totally makes sense and I did double check and had a typo.
As a side question to this, I have a field name with a colon in it, and it works for count but wont work for sum. This now makes more sense to me because count ignores field name, but is there a way to escape or handle a field name with a colon in it? Or if I to create a visualization in Timelion on this field I need to change the name to not include a colon?
Are there any other reserved characters i should also avoid if I need to change it?
EDIT: Also querying on these fields with colons in the name works fine in a normal kibana everything else (that I have tried), I am curious why it isn't supported in timelion.
unfortunately you currently cannot do this with a colon in the field name, since we use the colon to split away the parameter. I created #22113 to track that issue of supporting field names with colon in there.
I think there are currently two reasonable workaround without you need to rename everything:
- You can create a scripted field in the index pattern, that just has a different non-colon containing name, that just returns the value of the other field:
as a script. You can now use that new field for metrics, as long as you set theindex
parameter for the.es` function in timelion to the exact name that index pattern has.
- From 6.4.0 onwards, you should be able to add a field alias to your mapping, that does not contain that colon.
I tried the scripted field route, and it wasn't working for me so I did some digging and it looks like Timelion doesn't support scripted fields until build 6.1 (https://github.com/elastic/kibana/pull/14700) so for my 5.4 instance it appears there is no workaround.
Thanks for your help, looks like I have to go back to the raw data to see if I can get that modified before indexing.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.