Skip to content

[Rollups] Combination charts should default to most granular data in the time interval #24059

@tbragin

Description

@tbragin

Based on my testing, it seems to be the case that when you create a chart with raw and rolled up data, Kibana defaults to the least granular time interval. Below see concrete example.

@alexfrancoeur @marius-dr Can someone confirm that I'm not missing something, and there isn't another way to configure rollups jobs / index patterns / charts, such that user would see the most granular data available in a combination chart?

And if I'm not, can we treat this as a feature request?

Example:

(1) Load the logs data set from sample data documentation
https://www.elastic.co/guide/en/kibana/current/tutorial-load-dataset.html

(2) Apply this rollup job and start it:

PUT _xpack/rollup/job/logstash
{
    "index_pattern": "logstash-*",
    "rollup_index": "logstash_rollup",
    "cron": "*/30 * * * * ?",
    "page_size" :1000,
    "groups" : {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "1h",
        "delay": "7d"
      },
      "terms": {
        "fields": ["clientip.keyword", "extension.keyword", "host.keyword", "referer.keyword", "request.keyword", "response.keyword", "url.keyword"]
      }
    },
    "metrics": [
        {
            "field": "bytes",
            "metrics": ["min", "max", "sum"]
        }
    ]
}

(3) Create a combination index pattern

(4) Create the following chart

screen shot 2018-10-11 at 1 20 53 am

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:VisualizationsGeneric visualization features (in case no more specific feature label is available)Feature:elasticsearchTeam:VisualizationsTeam label for Lens, elastic-charts, Graph, legacy editors (TSVB, Visualize, Timelion) t//blockedenhancementNew value added to drive a business result

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions