Confusion Regarding Unstable Bucket-ing in Kibana Visualizations

[LeeDr (Lee Drengenberg)]

Here's another similar post;

Average value change when filtering or changing size

This sounds like the effect of merging the results from independent shards into a single response, which is generally considered an approximation and with smaller result sizes (when compared to the cardinality) can sometimes result in inaccurate results. Check out https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#_shard_size_3 I suggest using the shard_size parameter in your terms aggregation to ensure that it pulls back enough ter…

I got an error when I tried shard_size:0 (thinking 0 makes it max out somehow?), but seems to work if I set it large.

Give that a try and see if you get the correct counts with it.

Looks like this;