Why Kibana "Visualize" does not show all records?


#1

Our ELK stack is storing database slow queries. From "Visualize" for the last 24 hours it shows only 424 total entries:

However, from "Discover" the entries in the same lapse of time are much more; for instance, there are 1243 counts only for the last hour, and 989 for the previous hour.
For the last 24 hours, Kibana "Discover" shows ~5700 records. Where are the ~5300 records missing in "Visualize"?


(Nathan Reese) #2

How is your Split Rows aggregation configured? One the discover tab, do you see pattern.keyword values that are not displayed in the visualize table?


#3

Split Rows Aggregation is done by Terms.

Yes, in Discover there are patterns that are not present in Visualize.


(Nathan Reese) #4

What value are you providing for size under terms aggregation?


#5

It's currently 8, but I've tried higher values and nothing changes (see the empty line at the bottom in the screenshot).


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.