Grafana removing duplicate values in fields

[pyttei]

• What Grafana version and what operating system are you using?
  8.3.4

• What are you trying to achieve?
  Trying to make a pie chart with values coming from a certain field.

• How are you trying to achieve it?
  I’m sending a log from elasticsearch with the field failure: [“Test failed”,“Test failed”]

• What happened?
  The pie chart only shows one count of “Test failed” even though it should show two. It is removing the duplicate. The log comes from a pipeline that does two tests concurrently.

• What did you expect to happen?
  Pie chart showing two counts of “test failed”. If I were to send for eg. field failure: [“Test failed”,“Failed to reserve resources”]. I would correctly show one count of “Test failed” and one count of “Failed to reserve resources”.

So basically I’m asking is how do I get Grafana to not remove duplicates.

[yosiasz]

Please post a sample es document (minus confidential data and field name) so that we can try it on our elastic search.

Otherwise it would be guess work without real data

[pyttei]

Well it doesn’t really matter. Any Json document like this. If you were to make Grafana pie out of the “failure”, it would only show it once.

{
  "_index": "testindex",
  "_id": "jasdgjkhUUGY6GUIY89",
  "_version": 1,
  "_score": 1,
  "_source": {
    "@timestamp": "2022-06-23T13:12:34.784Z",
    "message": "request accepted",
  "fields": {
    "service.id": [
      "8907236kodhno908974"
    ],
    "service.node.name": [
      "elastic-893425534"
    ],
    "user_agent.original.text": [
      "hello"
    ],
    "failure": [
      "test failed",
      "test failed"
    ]
  }
}

[yosiasz]

it might not matter to you but it does to one that is trying to answer your question.

Using json api.

$._source.fields.failure[*]

or infinity UQL

parse-json
| scope "_source"
| project "fields"
| project "failure"

[pyttei]

I can’t choose all fields:

This is how the query looks like: