Different Values in Kibana Table from Kibana Discover

Hi, I am getting a deviation in values in Kibana Visualize and Kibana Discover.
Here is the screenshot for the value on 01-01-2022 00:00:00

The value on 02-01-2022 00:00:00

While in the Visualization they do not tally:
the visualization has a column Starting Value i.e., sorted on time in ascending order which should be for 01-01-2022 00:00:00 and the Ending Value sorted on time in descending order which should be for 02-01-2022 00:00:00. Here is the screenshot of the visualization.

The query for the Visualization is:

{
  "aggs": {
    "7": {
      "terms": {
        "field": "device.keyword",
        "order": {
          "_key": "desc"
        },
        "size": 1000
      },
      "aggs": {
        "1": {
          "top_hits": {
            "docvalue_fields": [
              {
                "field": "value"
              }
            ],
            "_source": "value",
            "size": 1,
            "sort": [
              {
                "measureTime": {
                  "order": "asc"
                }
              }
            ]
          }
        },
        "2": {
          "top_hits": {
            "docvalue_fields": [
              {
                "field": "value"
              }
            ],
            "_source": "value",
            "size": 1,
            "sort": [
              {
                "measureTime": {
                  "order": "desc"
                }
              }
            ]
          }
        }
      }
    }
  },
  "size": 0,
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "measureTime",
      "format": "date_time"
    },
    {
      "field": "persistTime",
      "format": "date_time"
    },
    {
      "field": "receiveTime",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "bool": {
            "minimum_should_match": 1,
            "should": [
              {
                "match_phrase": {
                  "register.keyword": "1-0:1.8.0*255"
                }
              }
            ]
          }
        },
        {
          "bool": {
            "minimum_should_match": 1,
            "should": [
              {
                "match_phrase": {
                  "group_field.current.device": "44050074"
                }
              }
            ]
          }
        },
        {
          "range": {
            "measureTime": {
              "gte": "2021-12-31T18:30:00.000Z",
              "lte": "2022-01-01T18:30:00.000Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

Could anyone help me out with the reason why the same value is deviating in the visualization from discover.
P.S: The Value in Discover is verified from cross-checking

How is value indexed? It's possible the number is actually too large for its type which will cause the Visualization to return a "wrong" result because it relies on the indexed value which can't hold the full precision. Discover OTOH depending on the version will use the _source object to fetch the value which means it didn't go through the indexing process but instead will keep the full precision javascript will handle (64 bit floating point).

If this is the case for you, consider changing your mapping of value to a data type which allows for larger values.

1 Like

Thanks @flash1293 for pointing out the cause of the problem.
Great Help man

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.