Skip to content

[ML] Make file/index data visualizer time field cards more similar #38102

@droberts195

Description

@droberts195

The index data visualizer's timestamp card for index patterns looks like this:

timestamp_card_index_pattern

But the timestamp card for uploaded files in the file data visualizer looks like this:

timestamp_card_file

We discussed this a couple of months ago and decided that the index data visualizer's display, i.e. showing earliest and latest timestamps, is better.

One thing to be aware of is that the file structure finder doesn't read the whole file. So the earliest and latest wouldn't refer to the whole file. However, now that people can change the number of lines to sample in the overrides dialog so that the whole file gets sampled this is probably OK. I guess we could say something like "earliest X, latest Y (based on first N messages in file)" on the card.

The backend change that is required to support this enhancement is elastic/elasticsearch#42890.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions