Aggregation Wildly Incorrect

Elastic Stack Kibana
1

We are seeing Kibana 7.6.1 (ES 7.6.2) return wildly incorrect numbers when calculating the average and maximum of a value. The data in question is 3 values for a field kpi1:

timestamp                 kpi1
2020-04-29T09:56:29         31
2020-04-29T10:02:17      10006
2020-04-29T10:04:57         47

Kibana displays this as:

image
image1070×432 27.9 KB

Kibana Inspect Shows:

timestamp       average      max
11:56:20       2656.341   240699
12:02:10       2746.293   241003
12:04:50       2665.325   241003

In no universe is this correct. IMHO this result should be:

timestamp       average      max
11:56:20             31       31
12:02:10          10006    10006
12:04:50             47       47
2

Comparing Aggregations between Kibana and ElasticSearch shows that ElasticSearch is able to provide the correct values.

Kibana Response:
image

Elastic Response (correct):

image
image532×640 8.37 KB

Aggregation Query (same in both cases):

  "aggs": {
    "2": {
      "date_histogram": {
        "field": "timestamp",
        "fixed_interval": "5s",
        "time_zone": "Europe/Paris",
        "min_doc_count": 1
      },
      "aggs": {
        "1": {
          "avg": {
            "field": "kpi1"
          }
        },
        "3": {
          "max": {
            "field": "kpi1"
          }
        }
      }
    }
  }
5

OK, I may have found the bug: Kibana seems to ignore the query

  "query": {
    "bool": {
      "must": [
        {
          "match_all": {
            
          }
        },

The query: id: 41 which came from the query string is ignored:
image

If I change the query (by adding a space) and refresh it picks it up.

6

Bug ticket (re-opened): https://github.com/elastic/kibana/issues/64989