Average value change when filtering or changing size

[LuigiAG (Luigi Gandossi)]

Hi,

I had a weird issue when I was editing new visualization on kibana.
I had the same issue with vertical bar and data table.

Here are the config :

When the size of X axis is 129, I have this result :

But when the size is 130 or when I only show the first value I have this :

CH has loosing 34 000 in execution time.

The first value when I show 129 person is wrong.

One more thing the time range does not influence anything, all data are from 5 days ago and I look for the last 30 days.

If someone has a clue or need more info

Thanks

[spalger (Spencer Alger)]

This sounds like the effect of merging the results from independent shards into a single response, which is generally considered an approximation and with smaller result sizes (when compared to the cardinality) can sometimes result in inaccurate results. Check out https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_shard_size_3

I suggest using the shard_size parameter in your terms aggregation to ensure that it pulls back enough terms to get an accurate enough result for your use case. The correct number is really based on the cardinality of your field, and the way it is sharded, but it seems you have found a good number to start with.