Create a set of documents in Elasticsearch

Oct 13, 2025 by talynt.org 121 views

Introduction

In the latest versions of Kibana, starting from 8.8, a bug has been introduced in the TSVB (Timeseries Visual Builder) feature. This bug causes a term like / in the TSVB legend to be converted to a (empty) string. This behavior is unwanted and was introduced as a patch to fix an issue in the TSVB markdown. However, the patch did not address the root cause of the problem.

Background

The bug was introduced in PR #154647 as a solution to an issue in the TSVB markdown. However, the patch applied was incorrect and did not fix the root cause of the problem. As a result, the / term is now being converted to a (empty) string, which is not the expected behavior.

Steps to Reproduce

To reproduce this bug, follow these steps:

Create a set of documents in Elasticsearch: Create a set of documents in Elasticsearch with a field that has a / as a keyword. For example, you can create a document with a field path that has a value of /home/user.
Create a timeseries chart: Create a timeseries chart in TSVB and select the field with the / keyword as the breakdown field.
Observe the legend/tooltip: Observe the legend or tooltip of the chart, and you will see that the breakdown field is displayed as (empty) instead of /.

Expected Behavior

The expected behavior is that only real empty values should be converted to a (empty) token. The / term should remain the same. If the problem is in the TSVB markdown, a better way to implement and escape it should be found, but the / term should not be replaced with another token.

Screenshots

Here is a screenshot of the issue:

Additional Context

This bug is a regression coming from PR #154647. The patch applied in this PR did not address the root cause of the problem, and as a result, the / term is now being converted to a (empty) string.

Conclusion

In conclusion, the bug in TSVB where the / term is converted to a (empty) string is an unwanted behavior that was introduced in Kibana version 8.8. This bug is a regression coming from PR #154647 and should be addressed to ensure that the / term remains the same in the legend and tooltip of the chart.

Workaround

Until this bug is fixed, a workaround can be applied to avoid this issue. The workaround is to use a different character instead of / in the breakdown field. For example, you can use a ~ or a | character instead of /.

Future Development

In the future, a better way to implement and escape the TSVB markdown should be found to avoid this issue. This can be achieved by using a more robust and flexible approach to handling special characters in the markdown.

Recommendations

Based on the analysis of this bug, the following recommendations can be made:

The bug should be fixed to ensure that the / term remains the same in the legend and tooltip of the chart.
A better way to implement and escape the TSVB markdown should be found to avoid this issue.
The workaround of using a different character instead of / should be documented and made available to users.

Introduction

In our previous article, we discussed the bug in TSVB where the / term is converted to a (empty) string. This bug was introduced in Kibana version 8.8 and is a regression coming from PR #154647. In this article, we will answer some frequently asked questions about this bug and provide additional information to help users understand and work around the issue.

Q: What is the cause of this bug?

A: The bug was introduced in PR #154647 as a solution to an issue in the TSVB markdown. However, the patch applied was incorrect and did not fix the root cause of the problem.

Q: How can I reproduce this bug?

A: To reproduce this bug, follow these steps:

Create a set of documents in Elasticsearch: Create a set of documents in Elasticsearch with a field that has a / as a keyword. For example, you can create a document with a field path that has a value of /home/user.
Create a timeseries chart: Create a timeseries chart in TSVB and select the field with the / keyword as the breakdown field.
Observe the legend/tooltip: Observe the legend or tooltip of the chart, and you will see that the breakdown field is displayed as (empty) instead of /.

Q: What is the expected behavior?

A: The expected behavior is that only real empty values should be converted to a (empty) token. The / term should remain the same. If the problem is in the TSVB markdown, a better way to implement and escape it should be found, but the / term should not be replaced with another token.

Q: How can I work around this bug?

A: Until this bug is fixed, a workaround can be applied to avoid this issue. The workaround is to use a different character instead of / in the breakdown field. For example, you can use a ~ or a | character instead of /.

Q: Is this bug specific to Kibana version 8.8?

A: No, this bug is not specific to Kibana version 8.8. It is a regression coming from PR #154647 and can affect any version of Kibana that includes this patch.

Q: How can I report this bug?

A: If you are experiencing this issue, you can report it to the Kibana team by creating an issue on the Kibana GitHub repository. Please include as much information as possible about the issue, including the steps to reproduce it and any relevant screenshots or logs.

Q: Will this bug be fixed in a future version of Kibana?

A: Yes, this bug will be fixed in a future version of Kibana. The Kibana team is working to resolve this issue and ensure that the / term is displayed correctly in the legend and tooltip of the chart.