alerting-kibana-plugin icon indicating copy to clipboard operation
alerting-kibana-plugin copied to clipboard

Use track_total_hits in generated query

Open dbbaughe opened this issue 4 years ago • 5 comments

See discussion here: https://discuss.opendistrocommunity.dev/t/extraction-query-response-limited-to-10000-hits/2701/3

dbbaughe avatar May 06 '20 22:05 dbbaughe

Note that issue #89 also gave a suggestion which seems a part of the demand in that topic: add track_total_hits to the search constructed by the visual graph.

ftianli-amzn avatar May 07 '20 05:05 ftianli-amzn

This is indeed a duplicate issue. Has there been any update or progress apart from the comms in #89 since this seems to be open for quite a while? To my experience I'd classify it as bug, as the alarm do not work as intended and as visualised, because of the 10k limit. this has created a lot of false-positives in my case.

use case: index has 1.500.000 records create an alarm that triggers when amount is below 1.000.000 alarm will always triggered on a below-threshold that is set above 10.000 as the result will never be more than 10.000

nean-and-i avatar May 08 '20 10:05 nean-and-i

Is there a workaround to this in Dashboards in the meantime? Is there some way I can inject track_total_hits into the query Dashboards is issuing?
Accurate count results in Dashboards is a critical function for our use case.

mhoydis13 avatar Nov 02 '21 18:11 mhoydis13

Is there a workaround to this in Dashboards in the meantime? Is there some way I can inject track_total_hits into the query Dashboards is issuing? Accurate count results in Dashboards is a critical function for our use case.

To add on to this question, having user queries in Dashboards only display a percentage of the results is incredibly confusing to users. And it's hard to explain that "well...sure opensearch knows how many results there are...it just doesn't actually return them all".

johnseekins avatar Nov 02 '21 18:11 johnseekins

It was suggested in the Jan 18 2022 Community Meeting that I ping this issue. Really itching for a fix, or even a workaround.
This affects not just Alerting but also any Visualization that uses the Count metric.

mhoydis13 avatar Jan 18 '22 18:01 mhoydis13