search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.82k stars 8.2k forks source link

[Lens] Ranking by the value is not working as expected #189158

Open tetianakravchenko opened 2 months ago

tetianakravchenko commented 2 months ago

Kibana version: 8.15

Elasticsearch version: 8.15

Original install method (e.g. download page, yum, from source, etc.):

Describe the bug:

Ranking by the value first provide fields with the null value. See the screenshot below

Expected behavior:

Expectations: empty values shouldn't be ranked when the filter is defined

Screenshots (if relevant): Only 1 pod that has the value - is in the bottom:

Screenshot 2024-07-25 at 10 56 22

Any additional context:

  1. Configuration: Filtering is added as an Advanced config: Screenshot 2024-07-25 at 10 56 22

Inspect > Request:

Request ``` POST /metrics-*/_async_search?batched_reduce_size=64&ccs_minimize_roundtrips=true&wait_for_completion_timeout=200ms&keep_on_completion=true&keep_alive=60000ms&ignore_unavailable=true&preference=1721892721604 { "aggs": { "0": { "date_histogram": { "field": "@timestamp", "fixed_interval": "30s", "time_zone": "Europe/Berlin", "extended_bounds": { "min": 1721896859811, "max": 1721897759811 } }, "aggs": { "1": { "terms": { "field": "kubernetes.pod.name", "order": { "2-bucket>2-metric": "desc" }, "size": 12 }, "aggs": { "2-bucket": { "filter": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "exists": { "field": "kubernetes.pod.cpu.usage.limit.pct" } } ], "minimum_should_match": 1 } } ], "should": [], "must_not": [] } }, "aggs": { "2-metric": { "avg": { "field": "kubernetes.pod.cpu.usage.limit.pct" } } } } } } } } }, "size": 0, "_source": { "excludes": [] }, "query": { "bool": { "must": [], "filter": [ { "match_phrase": { "data_stream.dataset": "kubernetes.pod" } }, { "range": { "@timestamp": { "format": "strict_date_optional_time", "gte": "2024-07-25T08:40:59.811Z", "lte": "2024-07-25T08:55:59.811Z" } } } ], "should": [], "must_not": [] } }, "stored_fields": [ "*" ], "runtime_mappings": {}, "script_fields": {}, "fields": [ { "field": "@timestamp", "format": "date_time" }, { "field": "event.ingested", "format": "date_time" }, { "field": "kubernetes.container.start_time", "format": "date_time" }, { "field": "kubernetes.node.start_time", "format": "date_time" }, { "field": "kubernetes.pod.start_time", "format": "date_time" }, { "field": "kubernetes.service.created", "format": "date_time" }, { "field": "kubernetes.storageclass.created", "format": "date_time" }, { "field": "kubernetes.system.start_time", "format": "date_time" }, { "field": "process.cpu.start_time", "format": "date_time" }, { "field": "system.process.cpu.start_time", "format": "date_time" } ] } ```

Result:

Screenshot 2024-07-25 at 11 05 22
  1. Move filtering to the top level: Screenshot 2024-07-25 at 11 06 21
Request ``` POST /metrics-*/_async_search?batched_reduce_size=64&ccs_minimize_roundtrips=true&wait_for_completion_timeout=200ms&keep_on_completion=true&keep_alive=60000ms&ignore_unavailable=true&preference=1721892721604 { "aggs": { "0": { "date_histogram": { "field": "@timestamp", "fixed_interval": "30s", "time_zone": "Europe/Berlin", "extended_bounds": { "min": 1721897456634, "max": 1721898356634 } }, "aggs": { "1": { "terms": { "field": "kubernetes.pod.name", "order": { "2": "desc" }, "size": 12 }, "aggs": { "2": { "avg": { "field": "kubernetes.pod.cpu.usage.limit.pct" } } } } } } }, "size": 0, "_source": { "excludes": [] }, "query": { "bool": { "must": [], "filter": [ { "bool": { "should": [ { "exists": { "field": "kubernetes.pod.cpu.usage.limit.pct" } } ], "minimum_should_match": 1 } }, { "match_phrase": { "data_stream.dataset": "kubernetes.pod" } }, { "range": { "@timestamp": { "format": "strict_date_optional_time", "gte": "2024-07-25T08:50:56.634Z", "lte": "2024-07-25T09:05:56.634Z" } } } ], "should": [], "must_not": [] } }, "stored_fields": [ "*" ], "runtime_mappings": {}, "script_fields": {}, "fields": [ { "field": "@timestamp", "format": "date_time" }, { "field": "event.ingested", "format": "date_time" }, { "field": "kubernetes.container.start_time", "format": "date_time" }, { "field": "kubernetes.node.start_time", "format": "date_time" }, { "field": "kubernetes.pod.start_time", "format": "date_time" }, { "field": "kubernetes.service.created", "format": "date_time" }, { "field": "kubernetes.storageclass.created", "format": "date_time" }, { "field": "kubernetes.system.start_time", "format": "date_time" }, { "field": "process.cpu.start_time", "format": "date_time" }, { "field": "system.process.cpu.start_time", "format": "date_time" } ] } ```
elasticmachine commented 2 months ago

Pinging @elastic/kibana-visualizations (Team:Visualizations)