TSVB timeseries broken?

[wlbsxnlp22]

Hi

The following is an attempt to display average response times across our different systems in one TSVB Timeseries.
Each series has its own separate index pattern. (There is no index main index pattern in panel options) The one from system three as you can see has its graph line at the bottom despite as you can se on the graph above having values basically as high as the other lines.

I can mix these response times from different indices without the last series line dropping to the absolute bottom of the graph as long as the indices have the same time format.

No amount of changing the duration either in index pattern or in the TSVB setting fixes this (though the actual numbers in the legend change and work)

Basically, why is the blue line still at the bottom when its number clearly shows it should be up with the other lines? Is this i bug or am I doing something wrong? Does anyone know of a fix?

The entire stack is version 7.11.2

[Badger]

This is not a logstash question, you might want to move it to a more appropriate forum. The kibana forum perhaps.

[wylie (Wylie Conlon)]

@wlbsxnlp22 Your screenshot and description are not enough to help you, we will need more information. The simplest explanation appears to be that your field names are not the same in each series. Maybe your data is not equivalent.

To rule out a configuration issue, can you either:

• Screenshot every panel in the TSVB UI, especially the Options for each series & panel options, as well as an updated screenshot that includes the right side of the chart
• Or export the TSVB saved object as JSON and share that here

[wlbsxnlp22]

Absolutely, thank you for taking the time,

A couple of notes, as you say the field names are not the same, do they have to be?
Data is also not equivalent, fields are either in milliseconds or seconds but reformatting them with data formatter setting in tsvb fixes them in the legend? So if it works in the legend shouldn't it work in the graph?

(I have also normalized those fields in the index pattern settings, changing the millisecond field from number to duration and converting from milliseconds to seconds in the index pattern, didn't work before that change and doesn't work after).

Legend:

System 1 series options:

System 2 series options:

System 3 series options: (The number is already seconds so I have tried with both Number and Duration, no difference.

Main Panel options: (left empty and unused)

[wylie (Wylie Conlon)]

Okay, so you are intentionally trying to mix one value that is stored in seconds with other values that are stored in milliseconds? All chart types in Kibana render their raw values (not formatted values) and then use formatters for displaying the tick marks. So your solution is to use TSVB math to either:

1. Divide the seconds by 1000, then format as if it is milliseconds
2. Multiply all the milliseconds by 1000, then format it as if it is seconds

This will normalize the raw numbers before formatting, and then after formatting.

[wlbsxnlp22]

I, see, thank you. All those settings give the impression of more control that you actually have then. I'll have to reread the data and fix the formatting in logstash, I have no idea how to what you are describing.

[wylie (Wylie Conlon)]

Oh, it's very simple. Here are the steps @wlbsxnlp22

1. In your third series that uses seconds, add a new aggregation underneath Average
2. Select Math, and under parameters type avg on the left input, and then select your Average of ... from the right input.
3. Under the math formula, type, params.avg / 1000
4. Go to the Options tab on this series and change the format