Bucket sorting gives different values

[Robert_Naccache]

Hello,

Something i noticed that's a bit off and i'm not sure exactly what's the cause of it.
My data is in the form of:

"businessevent": "GENERICPGPFILESOUTGOING",
"jobid": 6054972458,
"start": "2018-02-09T11:22:05.443Z",
 "difference": 1.574

And i'm trying to create a horizontal bar graph which has

X axis - average difference
Y axis - buisness event

Something like this:

Now my issue is when sorting the bucket.
What i want to do is sort it by greatest AVG and descending (like in the above snapshot).
When i do it this way, hovering the mouse over the business event gives me the wrong value (in this case 2.352) and when i filter it based on the businessevent, it gives me the correct one.

I also noticed that when i sort it differently (i.e. based on term, or max value, etc) it comes out fine on both cases.

My bucket looks like this:

Any ideas? (sorry if the screen shots don't display, but it was the easiest way for me to describe my issue)

Thanks in advance!

[Brandon_Kobel]

Hey @Robert_Naccache which version of Kibana are you running?

[Robert_Naccache]

Hi Brandon,

Sorry i didn't notice there was a reply to this post!

I'm in the middle of updating Kibana/elasticsearch so i have the issue on both 6.1.3 and 5.6.4

Regards,
Robert

[Brandon_Kobel]

Hey @Robert_Naccache I'm having trouble recreating this issue on 6.1.3, could you mind attaching a screenshot of the full chart configuration?

[Robert_Naccache]

by full chart configuration, you mean this?

Just to kind of show you, i left the mouse over and you can see that the value is 55.979
Once i click on the buisness event (to filter it out)

Value drops to 18.66 (which is the correct one, i aggregated it on elasticsearch)

Weird thing is, if i change the bucket "order by" to some other metric (i.e. by max value) it works normally.

[Brandon_Kobel]

Hey @Robert_Naccache the values that we display here come from Elasticsearch and are likely a result of the following: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-approximate-counts