Kibana: TSVB Markdown Top Date Value Shows Array of Dates

[MakoWish]

Kibana version: 7.8.1

Elasticsearch version: 7.8.1

Server OS version: Ubuntu 20.04 LTS

Browser version: Google Chrome 84.0.4147.125

Browser OS version: Windows 10 2004 Enterprise

Original install method (e.g. download page, yum, from source, etc.): Debian repository

Describe the bug: TSVB shows more than one date even when specifically stating you only want the top 1 record

Steps to reproduce:

1. Create Markdown TSVB
2. Select any field of type: "date"
3. Aggregation: Count
4. Group By: Terms
5. By: your.date.field
6. Top: 1
7. View the Markdown visualization showing a large array of dates instead of the specified "1"

Expected behavior: Should only show 1 date

Screenshots (if relevant): https://discuss.elastic.co/t/tsvb-markdown-dates/215916

Errors in browser console (if relevant): None

Provide logs and/or server output (if relevant): Not relevant

Any additional context: This was brought up back in January by Mack_rogers, and there was a suggestion to file a bug report. There is no indication as to whether it was reported or not, and the thread is now closed:

https://discuss.elastic.co/t/tsvb-markdown-dates/215916

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[stratoula]

I think this explains the behaviour of TSVB, I think it works as expected :)

[MakoWish]

@stratoula I still do not feel that TSVB is working as expected. The suggestion at the bottom of the page you linked said to use last.formatted. In both the screenshots from that post, and my own console, last.formatted only displays "0". This does not give me the formatted date value I am after. I am totally open to other suggestions, but at this point, I feel not being able to display a formatted date value is a bug. I need to display several different fields from the top 1 document returned, and a date field is one of them (not @timestamp).

I am not sure how to post a screenshot here, but a record will contain user.name, user.last_logon, etc. The last_logon field is a date retrieved from Active Directory. This field is indexed as a Date type, and it displays just fine in Data Tables, Discover, etc. Here is a snippet copy/pasted from Discover:

user.name | jdoe
user.last_logon | May 28, 2020 @ 17:41:15.000

Now in TSVB, I add the fields I want to display, using only the above two as examples, and these are my options presented:

{{ jdoe.user_name.last.raw }} | “0”
{{ jdoe.user_name.last.formatted }} | “0”
{{ jdoe.user_name.data.raw }} | [ [ “1597781400000”, “0” ], ... ]
{{ jdoe.user_name.data.formatted }} | [ [ “Aug 19, 2020 @ 13:58:20.000”, “0” ], ... ]
{{ jdoe.label }} | “jdoe”
{{ 1590687675000.last_logon.last.raw }} | “0”
{{ 1590687675000.last_logon.last.formatted }} | “0”
{{ 1590687675000.last_logon.data.raw }} | [ [ “1597867100000”, “0” ], ... ]
{{ 1590687675000.last_logon.data.formatted }} | [ [ “Aug 19, 2020 @ 13:58:20.000”, “0” ], ... ]
{{ 1590687675000.label }} | “-1590687675000”

It appears the only correct value for the last_logon variable is the label (but negative???), but it is in epoch time. The data.raw and data.formatted both show NOW, and the last.raw and last.formatted always show "0". How do I display the "label" value as a human-readable date in TSVB Markdown just as it displays everywhere else in Kibana?

[stratoula]

@MakoWish I see, you can use the label but you prefer a more human-readable format. We will look into this! Thanks for sharing :)

[MakoWish]

Thank you @stratoula !