TSVB table results greater than 12 hours results in an error

[fidsamurai (Firdaus Aga)]

Hi All,

I have a bit of a strange issue -
I have created a TSVB table with 8 columns.
3 are normal count columns.
The remaining 5 are filter ratios.

The weird scenario is that if we keep the time to "Last 12 hours", we get results.
However if we go beyond 12 hours we get no results.

Steps I've tried -
Increased the Kibana Search timeout to 3000000.
Increased the TSVB maxbuckets to 6000

Please help.
ELK - 7.13.4

[John_Guzman (Jhon Guzmán)]

Hello!

The problem could be the "data timerange mode" option in the "Panel options" panel. Use the "Entire time range" option so the graph would be shown as the metric calculations of all the data on the date range chosen in the time picker. With the "Last value" option the graph will show only the data of the last bucket, that sometimes this could be empty

Regards

[fidsamurai (Firdaus Aga)]

Hi @John_Guzman,

I'm already using the "Entire time range" option.
I do have something like 75 million documents in 24 hours though, is there a data fetching limit or a timeout that could be causing this issue?

Edit - Also I don't know if this makes any actual difference but I'm using a TSVB table not a graph.

[John_Guzman (Jhon Guzmán)]

Uhmm. Elasticsearch or Kibana logs reporting something? There is no limit, but in large request that an index can't handle usally appears a notification with the timeout error in Kibana.

[fidsamurai (Firdaus Aga)]

I'm attaching the screenshots of the error -

1. Dashboard error(I've had to redact the data however I've left the columns)

2. TSVB error -

Also we get a pretty dramatic spike in the CPU from 30% to 90%.
Elasticsearch and Kibana are on the same server and they communicate on their default ports.

Kibana logs -
["error","plugins","dataEnhanced","data_enhanced"],"pid":6660,"message":"Error while updating search session 7e3db2df-c4c0-4070-908c-acd62c31b802: Saved object [search-session/7e3db2df-c4c0-4070-908c-acd62c31b802] conflict"}

That's the only log I could get which could be an error.
Nothing in Elasticsearch.

[fidsamurai (Firdaus Aga)]

Can someone help with this please?