TSVBedit

TSVB enables you to visualize the data from multiple data series, supports most Elasticsearch metric aggregations, multiple visualization types, custom functions, and some math. To use TSVB, your data must have a date field.

Open and set up TSVBedit

Open TSVB, then make sure the required settings are configured.

  1. On the dashboard, click Create panel.
  2. On the New visualization window, click TSVB.
  3. In TSVB, click Panel options, then make sure the following settings are configured:

    • Index pattern
    • Time field
    • Interval
  4. Select a Drop last bucket option. It is dropped by default because the time filter intersects the time range of the last bucket, but can be enabled to see the partial data.
  5. In the Panel filter field, specify any KQL filters to select specific documents.

Configure the seriesedit

Each TSVB visualization shares the same options to create a Series. Each series can be thought of as a separate Elasticsearch aggregation. For each series, the Options control the styling and Elasticsearch options, and are inherited from Panel options. When you have separate options for each series, you can compare different Elasticsearch indices, and view two time ranges from the same index.

To configure the value of each series, select the function, then configure the function inputs. Only the last function is displayed.

  1. From the Aggregation dropdown, select the function for the series.
  2. To display each group separately, select one of the following options from the Group by dropdown:

    • Filters — Groups the data into the specified filters. To differentiate the groups, assign a color to each filter.
    • Terms — Displays the top values of the field. The color is only configurable in the Time Series chart. To configure, click Options, then select an option from the Split color theme dropdown.
  3. Click Options, then configure the inputs for the function.

TSVB visualization optionsedit

The configuration options differ for each TSVB visualization.

Time Seriesedit

By default, the y-axis displays the full range of data, including zero. To automatically scale the y-axis from the minimum to maximum values of the data, click Data > Options > Fill, then enter 0 in the Fill field. You can add annotations to the x-axis based on timestamped documents in a separate Elasticsearch index.

All chart types except Time Seriesedit

The Data timerange mode dropdown in Panel options controls the timespan that TSVB uses to match documents. Last value is unable to match all documents, only the specific interval. Entire timerange matches all documents specified in the time filter.

Metric, Top N, and Gaugeedit

Color rules in Panel options contains conditional coloring based on the values.

Top N and Tableedit

When you click a series, TSVB applies a filter based on the series name. To change this behavior, click Panel options, then specify a URL in the Item URL field, which opens a URL instead of applying a filter on click.

Markdownedit

The Markdown visualization supports Markdown with Handlebar (mustache) syntax to insert dynamic data, and supports custom CSS using the LESS syntax.

TSVB function referenceedit

TSVB provides you with shortcuts for some frequently-used functions.

Filter Ratio
Returns a percent value by calculating a metric on two sets of documents. For example, calculate the error rate as a percentage of the overall events over time.
Counter Rate
Used when dealing with monotonically increasing counters. Shortcut for Max, Derivative, and Positive Only.
Positive Only
Removes any negative values from the results, which can be used as a post-processing step after a derivative.
Series Agg
Applies a function to all of the Group by series to reduce the values to a single number. This function must always be the last metric in the series. For example, if the Time Series visualization shows 10 series, the sum Series Agg calculates the sum of all 10 bars and output a single Y value per X value. This is often confused with the overall sum function, which outputs a single Y value per unique series.
Math
The math context is able to do simple and advanced calculations per series. This function must always be the last metric in the series.

Frequently asked questionsedit

For answers to frequently asked TSVB question, review the following.

Why is my TSVB visualization missing data?edit

It depends, but most often there are two causes:

  • For Time series visualizations with a derivative function, the time interval can be too small. Derivatives require sequential values.
  • For all other TSVB visualizations, the cause is probably the Data timerange mode, which is controlled by Panel options > Data timerange mode > Entire time range. By default, TSVB displays the last whole bucket. For example, if the time filter is set to Last 24 hours, and the current time is 9:41, TSVB displays only the last 10 minutes — from 9:30 to 9:40.
How do I calculate the difference between two data series?edit

Performing math across data series is unsupported in TSVB. To calculate the difference between two data series, use Timelion or Vega.

How do I compare the current versus previous month?edit

TSVB can display two series with time offsets, but it can’t perform math across series. To add a time offset:

  1. Click Clone Series, then choose a color for the new series.

    Clone Series action
  2. Click Options, then enter the offset value in the Offset series time by field.
How do I calculate a month over month change?edit

The ability to calculate a month over month change is not fully supported in TSVB, but there is a special case that is supported if the time filter is set to 3 months or more and the Interval is 1m. Use the Derivative to get the absolute monthly change. To convert to a percent, add the Math function with the params.current / (params.current - params.derivative) formula, then select Percent from the Data Formatter dropdown.

For other types of month over month calculations, use Timelion or Vega.

How do I calculate the duration between the start and end of an event?edit

Calculating the duration between the start and end of an event is unsupported in TSVB because TSVB requires correlation between different time periods. TSVB requires that the duration is pre-calculated.