Timelion top 5 not working compared to TSVB top 5

Elastic Stack Kibana
1

Hi, I have this top 5 interfaces based on the average of utilization, in TSVB last 24 hours

image
image1231×562 69.9 KB

But when I try to do the same in canvas using Timelion with this query

.es(q='tenant name.keyword : LABSAV',index='metric-interface*',
    timefield='@timestamp', split=q_interface_name.keyword:5,metric=avg:utilization).label(regex='.*q_interface_name\.keyword:(.*) > .*',label='$1')

I get a different graph, with other interfaces as a top 5

image
image764×316 22.7 KB

what Im doing wrong?

2

I tried a setup pretty close to yours, and I don't see the issue that you are getting.

When you view the TSVB chart, are you applying the tenant name.keyword : LABSAV filter?

3

yes, it has that filter....could be the timezone? seems that in cavas shows the data in UTC

4

Is the TSVB chart also embedded in the Canvas worksheet when you see the problem?

5

Hi Tsullivan, I didnt even know this was possible...no its not embedded.....I have just realized that theres a embed object button in canvas, but when I click on it no object is listed, and I have many visualizations....its only for maps? in kibana 7.6

image
image736×218 11.7 KB

6

In 7.6, Maps are the only visualization type that can be embedded. I believe 7.7 allowed all the other visualizations including TSVB.

7

There are a few timezone-related timelion issues in Canvas right now. This is possibly related: Timelion query not respecting timezone parameter · Issue #67751 · elastic/kibana · GitHub

Like Corey mentioned above, hopefully a possible workaround could be upgrading and using the TSVB visualization directly in your workpad