Nope, this is actually correct. What it's showing you is the top 5 users per bucket; that is, per time division. So here, your results are being split on 30 second intervals, so for each of those 30 second chunks, it is returning the top 5, so you end up with a lot more the 5 users total. It's a side effect of how query results work in Elasticsearch. I hope that makes sense.
1 Like