search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.82k stars 8.2k forks source link

[Lens] Quick Function Differences, timeshift confusing behavior #189186

Open frederikb96 opened 2 months ago

frederikb96 commented 2 months ago

Kibana version: 8.8.1

Original install method (e.g. download page, yum, from source, etc.): Strigio Subscription Lab

Description of the problem including expected versus actual behavior: When using the Difference quick function in a Lens Visualization, the timeshift is counter intuitive and confusing for the user. There is a default time shift of 1 bucket and addiitonal timeshifts will be applied when setting the timeshift. This is confusing since if you set the timeshift to 1 day, instead it time shifts everything to 1 bucket + 1 day. Intenden behavior would be to set the timeshift to the value that is configured in timeshift. The default value would be equal to 1 bucket, e.g. 1 day but if the user changes it, it should be changed absolutely as well.

Here example for better understanding:

  1. We create a Difference quick function, and set the timeshift to 1 day, since we want to see the difference to the previous day: image

  2. We apply the changes, and it is shifted two days. See the manual formular as reference, which is doing it correctly. image

  3. So we go to timeshift settings again, and remove the timeshift, and set it to none. And voila, now it is correct and the default timeshift is applied, which is 1 bucket = 1 day. image

  4. So Picture 2. is quite confusing, timeshift is set to 1 day, but it is shifted 2 days. Better to not add this relative timeshift and only set one bucket as the default value for the timeshift, in my opinion :)

elasticmachine commented 2 months ago

Pinging @elastic/kibana-visualizations (Team:Visualizations)

dej611 commented 2 months ago

I've tested it locally and I can see how this can be confusing. There's a logic in there but perhaps we could improve how we express that.

When you define a Differences( Average) operation in Quick function you are effectively doing what's happening with the formula: average( field) - average( field, shift='1d'). When a TimeShift parameter it is added, that's applied to the entire Differences expression underneath, so the equivalent formula would be: average( field, shift="1d") - average( field, shift="2d").

Perhaps we could rephrase better or explain it a bit for all advanced functions like Differences, Moving_average, etc... the effect of a timeshift.

frederikb96 commented 2 months ago

Thanks for the fast reply :) Yes that was what I was hoping for. It took me a long time to figure out that the problem was with the additional offset, so I just posted this to help others in the future :) Moreover, this is also relevant for the Analyst certificate and there are questions in the exam exactly about this functionality :)