timechart: handling null values in series keys

[go-oleg]

When there is no keyField specified, the timechart attempts to bucket points into series based on the values of all non-numeric fields (excluding the timeField). When build the label for a given series, we show the name and values for all the "key fields" for a series unless the value is null.

The question is, should we completely ignore null values when bucketing points into series to begin with? Put another way, should we treat a point that has a null value for a field vs not having a field at all as belonging to different series?

Here is where the current behavior surfaces and causes confusion...

Juttle:

emit -points [
{time: :now:, name: "metric1", host: "A", value: 1},
{time: :now:, name: "metric2", host: "A", value: 1},
{time: :now: + :1s:, name: "metric1", host: "A", value: 2, numCores: null},
{time: :now: + :1s:, name: "metric2", host: "A", value: 2, numCores: null}
]| view timechart

Generated series labels:

It looks like the same series is showing up multiple times but in reality they differ by whether numCores is null or missing. Note that we get the same exact result if the first two points had contained numCores: 1 because we ignore numeric fields when determining series.

My proposal is that we when it comes to bucketing points into series, we ignore fields with null values.

@demmer, @dmehra, thoughts?

[demmer]

My proposal is that we when it comes to bucketing points into series, we ignore fields with null values.

I agree this seems like the most sensible behavior.

[dmehra]

+1