Why elasticsearch/kibana changes format of data?

Elastic Stack Kibana
1

Hello!

I have the following values of build Duration (seconds) in Jenkins.
Failed #28 0.75 sec master
Failed #27 0.44 sec master
Failed #26 0.46 sec master
Failed #25 0.55 sec master

Logstash plugin's in jenkins sent this values to elasticsearh

Also in kibana I see these values (not in seconds format):

data.buildNum: 28 data.buildDuration: 461
data.buildNum: 27 data.buildDuration: 392
data.buildNum: 26 data.buildDuration: 398
data.buildNum: 25 data.buildDuration: 513

Anyone know why these values change it?. Or How to format the value in kibana?

Regards,

2

Kibana should simply be showing the values of data.buildDuration as they exist in Elasticsearch. It's probably an issue with the Logstash config. If you query Elasticsearch directly for the values, do you see something else?

3

this is the result of query to elasticsearch

"buildHost":"Jenkins","buildLabel":"master","buildNum":28,"buildDuration":461,

4

Alright, so the value in Elasticsearch is 461, and that's what you see in Kibana. This is what I was expecting to see. Something is not working the way you expect at the indexing stage. The value in Elasticsearch and the value in Kibana are the same, but it's not what you expected.

Maybe what the Logstash plugin is actually setting is the millisecond value? It doesn't seem to line up quite that way though. Maybe the value it records isn't supposed to correspond directly to the "sec" value you see in the build duration output?

5

I check it the code of logstash plugin

"protected long buildDuration;"
"buildDuration = currentTime.getTime() - build.getStartTimeInMillis();"

6

Based on those variable names, it sounds like the buildDuration is in fact in milliseconds then. You can either convert it to another format, like seconds, at index time if you'd like, or you can use the duration field formatter in Kibana to make it show as seconds on the fly.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.