elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.78k stars 8.19k forks source link

[ES|QL] Kibana displays sparse(barely visible) histogram when user switches to ES|QL mode from non-es|ql mode for the same dataview #184070

Open bhavyarm opened 4 months ago

bhavyarm commented 4 months ago

Kibana version: main(serverless observability project)

Browser version: Chrome latest

Browser OS version: OS X

Describe the bug: For the same dataview when user switches to ES|QL mode - Kibana displays sparse and barely visible histogram.

This is possibly due to the shape of the data and the limit setting in ES|QL. If you try hard you can see the bars.

https://github.com/elastic/kibana/assets/7074629/d4392f81-bff7-40fa-a33e-92d62a13db09

Screenshot 2024-05-22 at 5 35 10 PM

Bars not visible even without the breakdown:

Screenshot 2024-05-22 at 5 46 52 PM

Non-esql mode:

Screenshot 2024-05-22 at 5 43 01 PM
elasticmachine commented 4 months ago

Pinging @elastic/kibana-esql (Team:ESQL)

drewdaemon commented 4 months ago

I looked at this with @bhavyarm and noticed that increasing the limit in the ES|QL query to 1000 doesn't really help (at least for this dataset).

This problem is also a timerange matter since a smaller time range that just captures the data makes a much better ES|QL histogram.

I think that brushing the chart to adjust the time range could help here, but maybe we can also improve the visibility of the data for this case during the transition from data view mode.

stratoula commented 4 months ago

The interval for the date histogram is being computed by this function https://github.com/elastic/kibana/blob/main/src/plugins/unified_histogram/public/utils/compute_interval.ts This is the same utility we are using in Vega

It might need some enhancement to take under consideration the actual data too but I am changing this to an enhancement. I am working on https://github.com/elastic/kibana/pull/184012 (brushing the date histogram) which will make the experience better for these cases

dej611 commented 3 months ago

Is it similar to #184205 ?

stratoula commented 3 months ago

@dej611 no I think is kind of different, this has to do with the function we are using for the intervals in Discover.