# Aggregation Wildly Incorrect

**URL:** <https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349>\
**Category:** Kibana\
**Created:** [April 29, 2020, 10:20am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349 "2020-04-29T10:20:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [April 29, 2020, 10:20am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349/1 "2020-04-29T10:20:50Z")

</div>

We are seeing Kibana 7.6.1 (ES 7.6.2) return wildly incorrect numbers when calculating the average and maximum of a value. The data in question is 3 values for a field kpi1:

```auto
timestamp kpi1
2020-04-29T09:56:29 31
2020-04-29T10:02:17 10006
2020-04-29T10:04:57 47

```

Kibana displays this as:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d73cfec9c0f436694f15eab4b331af7c56ae376.png)

Kibana Inspect Shows:

```auto
timestamp average max
11:56:20 2656.341 240699
12:02:10 2746.293 241003
12:04:50 2665.325 241003

```

In no universe is this correct. IMHO this result should be:

```auto
timestamp average max
11:56:20 31 31
12:02:10 10006 10006
12:04:50 47 47

```

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [April 29, 2020, 10:31am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349/2 "2020-04-29T10:31:22Z")

</div>

Comparing Aggregations between Kibana and ElasticSearch shows that ElasticSearch is able to provide the correct values.

Kibana Response:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2b915ddc06de18afa6d8cfcde0442e182383e1b9.png)

Elastic Response (correct):

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/3/63c8cbcdac5bdc6dbf3b8ea8954de5d9475f5abe.png)

Aggregation Query (same in both cases):

```auto
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "timestamp",
        "fixed_interval": "5s",
        "time_zone": "Europe/Paris",
        "min_doc_count": 1
      },
      "aggs": {
        "1": {
          "avg": {
            "field": "kpi1"
          }
        },
        "3": {
          "max": {
            "field": "kpi1"
          }
        }
      }
    }
  }

```

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [May 1, 2020, 6:25am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349/5 "2020-05-01T06:25:42Z")

</div>

OK, I may have found the bug: Kibana seems to ignore the query

```auto
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {
            
          }
        },

```

The query: `id: 41` which came from the query string is ignored:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/b/eb8488ba0805f26a013ec784cc293a2c2be9ad4f.png)

If I change the query (by adding a space) and refresh it picks it up.

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [May 1, 2020, 6:29am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349/6 "2020-05-01T06:29:26Z")

</div>

Bug ticket (re-opened): [https://github.com/elastic/kibana/issues/64989](https://github.com/elastic/kibana/issues/64989)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2020, 6:29am UTC](https://discuss.elastic.co/t/aggregation-wildly-incorrect/230349/7 "2020-05-29T06:29:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.