Have you maybe tried changing in the index the number format? It might be the first place to look. Not an expert, so might not be, but would be the first place I would perhaps look.
Settings, click on the index name, find the field that the Y axis is, and change to type number and check the number format.
Might be completely off the mark though.
In the screen shot, are you talking about the last bit there where the line hits 0 and stays there? What does the actual data look like in elasticsearch? Since the older events are getting graphed correctly, this seems like it's a data problem.
Actual data in ES is never zero for that graph. Thats so weird, working graph suddenly started hitting towards zero,even though its data is never zero. I even tried changing the index number format for that field, that wasn't very helpful either.
Yeah there's gotta be something odd going on here. What happens if you go to Discover and drill down to the time range where all the values look like they're zero? Do you still see hits in Discover? What values do you see for the field you're visualizing?
Exactly thats where i checked, and they are never zero when i type the search query on the discover. they are decimal values less then 1, like 0.023, 0.0045 etc
Hmmm, when you hover your mouse over the "zero" values in the graph, does the the tooltip say the value is actually zero? Maybe they're just especially small compared to the prior values? Just throwing out guesses.
The values are not zero, when i run the search query in discover for that time frame, its never zero. But shows zero in the visualization. have no idea, why is behaving like that.
Unfortunately I don't have any more ideas off the top of my head, I think you'll need to dig into the query that backs the viz you're looking at and see why it's returning 0 values. You can open the "Spy panel" by clicking the arrow at the bottom of the visualization. You'll get a tabular view of the data in the chart which you can drill down into by clicking the specific dates with the 0 values. It'll look something like this
You can then click the "Request" tab and see the actual query (and "Response" to see the raw response) that's run against elasticsearch. I'd inspect that query and try to figure out why it's returning zero values for those buckets at the end of the time range.
Similar issue was reported, and i tried this one as well, but no luck.
I'd recommend opening another Github ticket with a reference to that one mentioning you've tried the solutions there and they haven't worked.
Also, please provide some sample data and mappings that we can use to reproduce the issue, as well as the versions of Kibana and ES you're using. The more info the better. If we can reproduce the issue on our end it'll make it much much easier to diagnose.
I didn't get the solution ? They just redirected me over here.
Thank you