[SIEM] Source & Destination IP tables show 0 for bytes when documents are missing bytes fields

[spong]

As uncovered in this community issue, when displaying APM transaction data (which lacks source.bytes and destination.bytes) on the Source & Destination IP tables, the Bytes in & Bytes out columns will show 0B even though none of the records have the corresponding fields. The table should instead display a -- to indicate the empty set, and that no data was found.

This is a by-product of using the sum aggregation in the query, which will return 0 when aggregating across a field that does not exist (in comparison to the avg agg, which will return null if the field is not present).

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[spong]

@MadameSheema this is still an issue as of the latest 7.9.0-snapshot.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security Solution)