[Kibana] [Timelion] ES Datasource Does Not Fit Null Values

[Sawadski]

Kibana version: 4.6.1

Elasticsearch version: 2.4.0

Server OS version: Debian 8

Browser version: Google Chrome Version 53.0.2785.116 (64-bit)

Browser OS version: OS X El Capitan Version 10.11.6

Original install method (e.g. download page, yum, from source, etc.):
Installed via Docker.

Description of the problem including expected versus actual behavior:
If we want to display a timeseries using timelion it actually is not plotted given special circumstances.
These circumstances are the datapoint interval (e.g. 10s) is larger than the timelion interval (e.g. 1s), we provided a metric parameter containing an aggregation function (e.g. "avg:my_metric") and we want to plot a line chart. Assume an existing metric with the name "my_metric". Then, a simple example would be:

.es(metric="avg:my_metric")

The main question which came up is the following.
The es data source has a fit parameter. Executing our example above returns a lot of {"value": null} data points. For details have a look at the partial elasticsearch response below. Why aren't they fitted to the nearest neighbor? The fit parameter seems to have no effect on the result. What is it for?

Chaining .fit(mode="nearest") to our data source solves the problem, but we don't want to call it all the time.

Steps to reproduce:

1. Write datapoints to elasticsearch containing the numeric field my_metric with an interval of 10 seconds for the last 15 minutes.
2. Start kibana and open timelion plugin.
3. Set time to Last 15 minutes.
4. Set interval to 1s.
5. Execute the query .es(metric="avg:my_metric").
6. This should result in an empty linegraph.

Errors in browser console (if relevant): none

Provide logs and/or server output (if relevant):

Partial elasticsearch response. Intercepted in the resp object.

[
  {
    "key_as_string": "2016-09-23T13:31:52.000Z",
    "key": 1474637512000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:53.000Z",
    "key": 1474637513000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:54.000Z",
    "key": 1474637514000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T15:31:55.000+02:00",
    "key": 1474637515000,
    "doc_count": 2,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:56.000Z",
    "key": 1474637516000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:57.000Z",
    "key": 1474637517000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:58.000Z",
    "key": 1474637518000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:31:59.000Z",
    "key": 1474637519000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:00.000Z",
    "key": 1474637520000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:01.000Z",
    "key": 1474637521000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T15:32:02.000+02:00",
    "key": 1474637522000,
    "doc_count": 4,
    "avg(kpis.throughput_in)": {
      "value": 1274180985
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:03.000Z",
    "key": 1474637523000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:04.000Z",
    "key": 1474637524000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:05.000Z",
    "key": 1474637525000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:06.000Z",
    "key": 1474637526000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:07.000Z",
    "key": 1474637527000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:08.000Z",
    "key": 1474637528000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:09.000Z",
    "key": 1474637529000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:10.000Z",
    "key": 1474637530000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:11.000Z",
    "key": 1474637531000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T15:32:12.000+02:00",
    "key": 1474637532000,
    "doc_count": 4,
    "avg(kpis.throughput_in)": {
      "value": 1467657791.6
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:13.000Z",
    "key": 1474637533000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:14.000Z",
    "key": 1474637534000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:15.000Z",
    "key": 1474637535000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:16.000Z",
    "key": 1474637536000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:17.000Z",
    "key": 1474637537000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:18.000Z",
    "key": 1474637538000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:19.000Z",
    "key": 1474637539000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:20.000Z",
    "key": 1474637540000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:21.000Z",
    "key": 1474637541000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
  {
    "key_as_string": "2016-09-23T15:32:22.000+02:00",
    "key": 1474637542000,
    "doc_count": 4,
    "avg(kpis.throughput_in)": {
      "value": 1216320801.4
    }
  },
  {
    "key_as_string": "2016-09-23T13:32:23.000Z",
    "key": 1474637543000,
    "doc_count": 0,
    "avg(kpis.throughput_in)": {
      "value": null
    }
  },
 ...
]

[numbnut]

I'm facing the same issue and I prepared a small docker setup in the following repo as a minimum working example.

https://github.com/numbnut/kibana-playground

Could you please verify whether this is a bug or not? Thanks!

[Sawadski]

I found some interesting behavior, when setting the fit parameter of the es data source.
To reproduce it follow the steps below:

1. Clone the kibana-playground repo
2. Setup everything according to the README.md
3. Compare the two queries: 

• .es(metric="avg:value") displays nothing
• .es(metric="avg:value", fit="average") displays a graph, but fitted with 0 values

I tested some available fit functions. "nearest" and "none" seems to return "fitted" null values.
"average" and "scale" seems to return fitted 0 values.
All functions do behave incorrectly, but I wanted to point out this difference.

Maybe this helps during investigating the bug.

[flash1293]

I traced back why this is happening. The fit argument of the series is only applied if the date buckets of the series are not the expected ones (ignoring the null values):

kibana/src/plugins/vis_types/timelion/server/lib/classes/timelion_function.js

Line 39 in e20f530

if (_.isEqual(_.map(series.data, 0), _.map(target, 0))) return series;

However, I don't see a way how this would ever happen, because the date histogram is parameterized to return the full range, including empty buckets:

kibana/src/plugins/vis_types/timelion/server/series_functions/es/lib/create_date_agg.js

Line 21 in e20f530

extended_bounds: {

If I would have to guess this was originally done to accomodate for other datasources that might not always return data in the expected format and was never meant to be used for the .es function - the config is also defined on the generic Datasource class, not the specific .es implementation:

kibana/src/plugins/vis_types/timelion/server/lib/classes/datasource.js

Line 41 in e20f530

name: 'fit',

This has been in there since timelion was merged into Kibana: #7994

As there's a workaround for this (explicitly calling .fit), I'm in favor of removing the fit property from the autocomplete to avoid user confusion (without failing existing sheets). What do you think @ghudgins ?