# Cardinality Limitation Work Around

**URL:** <https://discuss.elastic.co/t/cardinality-limitation-work-around/339453>\
**Category:** Elasticsearch\
**Created:** [July 27, 2023, 2:44pm UTC](https://discuss.elastic.co/t/cardinality-limitation-work-around/339453 "2023-07-27T14:44:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![edang](https://avatars.discourse-cdn.com/v4/letter/e/a183cd/32.png) [@edang](https://discuss.elastic.co/u/edang)\
**Post date:** [July 27, 2023, 2:44pm UTC](https://discuss.elastic.co/t/cardinality-limitation-work-around/339453/1 "2023-07-27T14:44:22Z")

</div>

Hi All,

With my data set I have seen a mismatch of data between ELK and my DB. For my purpose, I have used the cardinality aggregation to count the unique ids of a field but ran into some issues. The issues comes from the cardinality aggregation, specifically the precision\_threshold is a default of 3,000. Anything over a precision\_threshold of 3,000 will have an approximate value which is not what I intend to do with my data.

I recognize that the precision\_threshold can be increased to an upper limit of 40,000 but that is far too low for my dataset (1 mil +~). Going through the logstash filter with the fingerprint function, I am able to create a new field with either 1 or 0 and using the summation aggregation. However, my problem comes from additional filters I need to sum using the same approach (using Sum instead of Cardinality).

My intent is to use ruby to make arrays of specific fields that all fall under a specific document id. I would appreciate some insight on this matter if anyone has tried a similar approach.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2023, 2:45pm UTC](https://discuss.elastic.co/t/cardinality-limitation-work-around/339453/2 "2023-08-24T14:45:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
