diff --git a/docs/index.asciidoc b/docs/index.asciidoc index 5213e5b39fbc9..b4f536bd872d6 100644 --- a/docs/index.asciidoc +++ b/docs/index.asciidoc @@ -13,7 +13,6 @@ include::{docs-root}/shared/versions/stack/{source_branch}.asciidoc[] :es-docker-image: {es-docker-repo}:{version} :blob: {kib-repo}blob/{branch}/ :security-ref: https://www.elastic.co/community/security/ - :data-source: index pattern :data-sources: index patterns :a-data-source: an index pattern diff --git a/docs/user/dashboard/tsvb.asciidoc b/docs/user/dashboard/tsvb.asciidoc index 322fa549f1354..2b71b1d7521cb 100644 --- a/docs/user/dashboard/tsvb.asciidoc +++ b/docs/user/dashboard/tsvb.asciidoc @@ -12,33 +12,11 @@ With *TSVB*, you can: * Use custom functions and some math on aggregations. * Customize the data with labels and colors. -[float] -[[tsvb-required-choices]] -==== Open and set up TSVB - -Open *TSVB*, then configure the required settings. - -. On the dashboard, click *All types*, then select *TSVB*. - -. In *TSVB*, click *Panel options*, then specify the required *Data* settings. - -.. From the *Index pattern* dropdown, select the index pattern you want to visualize. -+ -To visualize the data in an {es} index, open the *Index pattern selection mode* menu, deselect *Use only {kib} index patterns*, then enter the {es} index. - -.. From the *Time field* dropdown, select the field you want to visualize, then enter the field *Interval*. - -.. Select a *Drop last bucket* option. -+ -By default, *TSVB* drops the last bucket because the time filter intersects the time range of the last bucket. To view the partial data, select *No*. - -.. To view a filtered set of documents, enter <> in the *Panel filter* field. - [float] [[tsvb-index-pattern-mode]] -==== Change the {data-source} mode +==== Open and set up TSVB -You can create *TSVB* visualizations with only {data-sources}, or {es} index strings. +Open *TSVB*, then configure the required settings. You can create *TSVB* visualizations with only {data-sources}, or {es} index strings. When you use only {data-sources}, you are able to: @@ -50,28 +28,56 @@ When you use only {data-sources}, you are able to: * Improve performance -IMPORTANT: Creating *TSVB* visualizations with an {es} index string is deprecated and will be removed in a future release. -It is the default one for new visualizations but it can also be switched for the old implementations: +IMPORTANT: Creating *TSVB* visualizations with an {es} index string is deprecated and will be removed in a fytyre release. By default, you create *TSVB* visualizations with only {data-sources}. To use an {es} index string, contact your administrator, or go to <> and set `metrics:allowStringIndices` to `true`. + +. On the dashboard, click *All types*, then select *TSVB*. -. Click *Panel options*, then open the *Index pattern selection mode* options next to the *Index pattern* dropdown. +. In *TSVB*, click *Panel options*, then specify the *Data* settings. -. Select *Use only Kibana index patterns*. +. Open the *Index pattern selection mode* options next to the *Index pattern* dropdown. -. From the *Index pattern* drodpown, select the index pattern, then select the *Time field*. +. Select *Use only {kib} {data-sources}*. + +. From the *Index pattern* drodpown, select the {data-source}, then select the *Time field* and *Interval*. + +. Select a *Drop last bucket* option. + -image::images/tsvb_index_pattern_selection_mode.png[Change index pattern selection mode action] +By default, *TSVB* drops the last bucket because the time filter intersects the time range of the last bucket. To view the partial data, select *No*. + +. To view a filtered set of documents, enter <> in the *Panel filter* field. [float] -[[configure-the-data-series]] +[[tsvb-function-reference]] ==== Configure the series Each *TSVB* visualization shares the same options to create a *Series*. Each series can be thought of as a separate {es} aggregation. -For each series, the *Options* control the styling and {es} options, and are inherited from *Panel options*. +The *Options* control the styling and {es} options, and are inherited from *Panel options*. When you have separate options for each series, you can compare different {es} indices, and view two time ranges from the same index. To configure the value of each series, select the function, then configure the function inputs. Only the last function is displayed. -. From the *Aggregation* dropdown, select the function for the series. +. From the *Aggregation* dropdown, select the function for the series. *TSVB* provides you with shortcuts for some frequently-used functions: ++ +*Filter Ratio*:: + Returns a percent value by calculating a metric on two sets of documents. + For example, calculate the error rate as a percentage of the overall events over time. ++ +*Counter Rate*:: + Used when dealing with monotonically increasing counters. Shortcut for *Max*, *Derivative*, and *Positive Only*. ++ +*Positive Only*:: + Removes any negative values from the results, which can be used as a post-processing step + after a derivative. ++ +*Series Agg*:: + Applies a function to all of the *Group by* series to reduce the values to a single number. + This function must always be the last metric in the series. + For example, if the *Time Series* visualization shows 10 series, the sum *Series Agg* calculates + the sum of all 10 bars and outputs a single Y value per X value. This is often confused + with the overall sum function, which outputs a single Y value per unique series. ++ +*Math*:: + For each series, apply simple and advanced calculations. Only use *Math* for the last function in a series. . To display each group separately, select one of the following options from the *Group by* dropdown: @@ -79,7 +85,7 @@ To configure the value of each series, select the function, then configure the f * *Terms* — Displays the top values of the field. The color is only configurable in the *Time Series* chart. To configure, click *Options*, then select an option from the *Split color theme* dropdown. -. Click *Options*, then configure the inputs for the function. +. Click *Options*, then configure the inputs for the function. For example, to use a different field format, make a selection from the *Data formatter* dropdown. [float] [[configure-the-visualizations]] @@ -121,37 +127,9 @@ To change this behavior, click *Panel options*, then specify a URL in the *Item The *Markdown* visualization supports Markdown with Handlebar (mustache) syntax to insert dynamic data, and supports custom CSS using the LESS syntax. -[float] -[[tsvb-function-reference]] -==== TSVB function reference - -*TSVB* provides you with shortcuts for some frequently-used functions. - -*Filter Ratio*:: - Returns a percent value by calculating a metric on two sets of documents. - For example, calculate the error rate as a percentage of the overall events over time. - -*Counter Rate*:: - Used when dealing with monotonically increasing counters. Shortcut for *Max*, *Derivative*, and *Positive Only*. - -*Positive Only*:: - Removes any negative values from the results, which can be used as a post-processing step - after a derivative. - -*Series Agg*:: - Applies a function to all of the *Group by* series to reduce the values to a single number. - This function must always be the last metric in the series. - For example, if the *Time Series* visualization shows 10 series, the sum *Series Agg* calculates - the sum of all 10 bars and output a single Y value per X value. This is often confused - with the overall sum function, which outputs a single Y value per unique series. - -*Math*:: - The math context is able to do simple and advanced calculations per series. - This function must always be the last metric in the series. - [float] [[save-the-tsvb-panel]] -===== Save and add the panel +==== Save and add the panel Save the panel to the *Visualize Library* and add it to the dashboard, or add it to the dashboard without saving.