Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion docs/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ include::{docs-root}/shared/versions/stack/{source_branch}.asciidoc[]
:es-docker-image: {es-docker-repo}:{version}
:blob: {kib-repo}blob/{branch}/
:security-ref: https://www.elastic.co/community/security/

:data-source: index pattern
:data-sources: index patterns
:a-data-source: an index pattern
Expand Down
104 changes: 41 additions & 63 deletions docs/user/dashboard/tsvb.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -12,33 +12,11 @@ With *TSVB*, you can:
* Use custom functions and some math on aggregations.
* Customize the data with labels and colors.

[float]
[[tsvb-required-choices]]
==== Open and set up TSVB

Open *TSVB*, then configure the required settings.

. On the dashboard, click *All types*, then select *TSVB*.

. In *TSVB*, click *Panel options*, then specify the required *Data* settings.

.. From the *Index pattern* dropdown, select the index pattern you want to visualize.
+
To visualize the data in an {es} index, open the *Index pattern selection mode* menu, deselect *Use only {kib} index patterns*, then enter the {es} index.

.. From the *Time field* dropdown, select the field you want to visualize, then enter the field *Interval*.

.. Select a *Drop last bucket* option.
+
By default, *TSVB* drops the last bucket because the time filter intersects the time range of the last bucket. To view the partial data, select *No*.

.. To view a filtered set of documents, enter <<kuery-query, KQL filters>> in the *Panel filter* field.

[float]
[[tsvb-index-pattern-mode]]
==== Change the {data-source} mode
==== Open and set up TSVB

You can create *TSVB* visualizations with only {data-sources}, or {es} index strings.
Open *TSVB*, then configure the required settings. You can create *TSVB* visualizations with only {data-sources}, or {es} index strings.

When you use only {data-sources}, you are able to:

Expand All @@ -50,36 +28,64 @@ When you use only {data-sources}, you are able to:

* Improve performance

IMPORTANT: Creating *TSVB* visualizations with an {es} index string is deprecated and will be removed in a future release.
It is the default one for new visualizations but it can also be switched for the old implementations:
IMPORTANT: Creating *TSVB* visualizations with an {es} index string is deprecated and will be removed in a fytyre release. By default, you create *TSVB* visualizations with only {data-sources}. To use an {es} index string, contact your administrator, or go to <<advanced-options, Advanced Settings>> and set `metrics:allowStringIndices` to `true`.

. On the dashboard, click *All types*, then select *TSVB*.

. Click *Panel options*, then open the *Index pattern selection mode* options next to the *Index pattern* dropdown.
. In *TSVB*, click *Panel options*, then specify the *Data* settings.

. Select *Use only Kibana index patterns*.
. Open the *Index pattern selection mode* options next to the *Index pattern* dropdown.

. From the *Index pattern* drodpown, select the index pattern, then select the *Time field*.
. Select *Use only {kib} {data-sources}*.

. From the *Index pattern* drodpown, select the {data-source}, then select the *Time field* and *Interval*.

. Select a *Drop last bucket* option.
+
image::images/tsvb_index_pattern_selection_mode.png[Change index pattern selection mode action]
By default, *TSVB* drops the last bucket because the time filter intersects the time range of the last bucket. To view the partial data, select *No*.

. To view a filtered set of documents, enter <<kuery-query, KQL filters>> in the *Panel filter* field.

[float]
[[configure-the-data-series]]
[[tsvb-function-reference]]
==== Configure the series

Each *TSVB* visualization shares the same options to create a *Series*. Each series can be thought of as a separate {es} aggregation.
For each series, the *Options* control the styling and {es} options, and are inherited from *Panel options*.
The *Options* control the styling and {es} options, and are inherited from *Panel options*.
When you have separate options for each series, you can compare different {es} indices, and view two time ranges from the same index.

To configure the value of each series, select the function, then configure the function inputs. Only the last function is displayed.

. From the *Aggregation* dropdown, select the function for the series.
. From the *Aggregation* dropdown, select the function for the series. *TSVB* provides you with shortcuts for some frequently-used functions:
+
*Filter Ratio*::
Returns a percent value by calculating a metric on two sets of documents.
For example, calculate the error rate as a percentage of the overall events over time.
+
*Counter Rate*::
Used when dealing with monotonically increasing counters. Shortcut for *Max*, *Derivative*, and *Positive Only*.
+
*Positive Only*::
Removes any negative values from the results, which can be used as a post-processing step
after a derivative.
+
*Series Agg*::
Applies a function to all of the *Group by* series to reduce the values to a single number.
This function must always be the last metric in the series.
For example, if the *Time Series* visualization shows 10 series, the sum *Series Agg* calculates
the sum of all 10 bars and outputs a single Y value per X value. This is often confused
with the overall sum function, which outputs a single Y value per unique series.
+
*Math*::
For each series, apply simple and advanced calculations. Only use *Math* for the last function in a series.

. To display each group separately, select one of the following options from the *Group by* dropdown:

* *Filters* &mdash; Groups the data into the specified filters. To differentiate the groups, assign a color to each filter.

* *Terms* &mdash; Displays the top values of the field. The color is only configurable in the *Time Series* chart. To configure, click *Options*, then select an option from the *Split color theme* dropdown.

. Click *Options*, then configure the inputs for the function.
. Click *Options*, then configure the inputs for the function. For example, to use a different field format, make a selection from the *Data formatter* dropdown.

[float]
[[configure-the-visualizations]]
Expand Down Expand Up @@ -121,37 +127,9 @@ To change this behavior, click *Panel options*, then specify a URL in the *Item

The *Markdown* visualization supports Markdown with Handlebar (mustache) syntax to insert dynamic data, and supports custom CSS using the LESS syntax.

[float]
[[tsvb-function-reference]]
==== TSVB function reference

*TSVB* provides you with shortcuts for some frequently-used functions.

*Filter Ratio*::
Returns a percent value by calculating a metric on two sets of documents.
For example, calculate the error rate as a percentage of the overall events over time.

*Counter Rate*::
Used when dealing with monotonically increasing counters. Shortcut for *Max*, *Derivative*, and *Positive Only*.

*Positive Only*::
Removes any negative values from the results, which can be used as a post-processing step
after a derivative.

*Series Agg*::
Applies a function to all of the *Group by* series to reduce the values to a single number.
This function must always be the last metric in the series.
For example, if the *Time Series* visualization shows 10 series, the sum *Series Agg* calculates
the sum of all 10 bars and output a single Y value per X value. This is often confused
with the overall sum function, which outputs a single Y value per unique series.

*Math*::
The math context is able to do simple and advanced calculations per series.
This function must always be the last metric in the series.

[float]
[[save-the-tsvb-panel]]
===== Save and add the panel
==== Save and add the panel

Save the panel to the *Visualize Library* and add it to the dashboard, or add it to the dashboard without saving.

Expand Down