[Monitoring] Logstash pipeline listing page show inaccurate rate data #55755
Labels
bug
Fixes for quality problems that affect the customer experience
Team:Monitoring
Stack Monitoring team
If you look at the pipelines overview page and note the events emitted rate, then go to the pipelines listing page and add up all the events emitted rate, the numbers are not the same (and not even close).
There are two things causing this:
uniq
is actually filtering our validhash
andephemeral_id
values that are necessary in the subsequent queries to collect all the datamin
frommax
leaves potential gaps of data that isn't included in the calculation in smaller bucket sizes - when looking at min/max in individual buckets, themax
of the first usable bucket doesn't always equal themin
of the next usable bucket and this becomes more prevalent when the number of documents per bucket is small.We need to make two fixes:
Fix the bug with the
uniq
above so it properly groups sets ofhash
andephemeral_id
values with each unique idChange how we collect the pipeline metric data for the listing page. Instead of a single query, we should issue multiple queries in parallel that only look at a single pipeline id (since we now have the list up-front). We want to rely on a ES derivative to do the calculations (to avoid the issues mentioned above) but in order to do that with the way logstash monitoring documents are structured, we need to do separate queries for individual pipeline ids.
cc @inqueue
The text was updated successfully, but these errors were encountered: