Bug in "Group other values in separate bucket" with x axis and split series by "Terms"

Elastic Stack Kibana
1

I have encountered a strange behaviour in Kibana when using the "Group other values in separate bucket" feature. You can see that when I use "Size=69" there is no problem, but when I change to "Size=68" a huge "Other" bucket is created.

Is this a bug or am I just misunderstanding the definition of the "Size" field? I was expecting that we could create a plot with "Size" buckets, then anything which doesn't fit into the first Size buckets (in decreasing order of the sorting method) would fall into the "Other" bucket. So when switching from Size=69 to 68 I would expect a new bucket called "Other" to be created with only 1 or 2 items in it, not ~180 as seen here.

Size=69: No problem I think:

image
image1709×760 176 KB

Size=68: Why is "Other" so big:

image
image1722×754 192 KB

I've been using the "Group other values in separate bucket" alot, but this behaviour above is making me doubt the correctness of plots using this feature entirely.

2

I think this is related on the number of shards that you have on your index as this is how Elasticsearch size works:
https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html

Can you show the request and response from viz in both cases from the Inspector menu?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.