[17:15:31] hi o11y folks, I have an elasticsearch/kibana question [17:15:43] https://i.imgur.com/NgNvWUm.png [17:16:03] this graph is a count query over time with a lot of filters applied [17:16:25] there are many time buckets with 0 hits, like you can see between the points at 15:40 and 16:25 [17:16:31] (or rather, the lack of points) [17:17:01] however, kibana interpolates the line so that it *looks* like there were hits in between, even though there weren't [17:17:21] I've found that I can turn off the line entirely in Kibana and have it just display the points, but that's not really legible for other reasons [17:17:41] is there maybe a way to tell Elasticsearch to return 0 for a time bucket if there were no hits? [17:20:41] I think this is exactly what the `min_doc_count` setting in a terms aggregation in ES is for? [17:20:49] but I don't see a way to set that in the panel UI in Kibana [17:24:17] ah! [17:24:18] cdanis: Good question. Maybe `{"min_doc_count": 0}` in the Advanced->JSON input field. Not sure which one it goes into though (X-Axis or Split Series). Give that a try? [17:24:35] cwhite: yeah, I originally tried that on Split Series, which did nothing -- but it needed to go on x-axis [17:24:51] Kibana was actually setting min_doc_count 1 on the x-axis one, which I figured out with the inspector [17:25:00] https://i.imgur.com/DQtgYgi.png [17:25:06] I really don't understand why this isn't the default... that's so much better [17:25:31] going to apply that to all of my timeseries graphs now heh [17:28:40] thanks for taking a look cwhite :) [17:28:50] :) [17:34:14] cdanis: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_minimum_document_count_4 [17:37:06] FWIW, we're not sharding quite like ES expects here, so the risk of using min_doc_count seems lessened (especially if the field is not high cardinality). [17:37:40] cool, makes sense. yeah, on the field in question in that graph there's a cardinality of about 20 :)