I don't get the same result with Split series/Sub aggregation/Terms

[anon89617342]

I'm creating multiple graphs on the same indices with Terms aggregation on Kibana. The wired thing is that sum of counts on each graph is not the same while the time range and search query is exactly the same.

Any idea how to debug this issue?

[bhavyarm]

Which version of stack you are at? Can you also please check your elasticsearch requests and responses on the charts? You can click on inspect and do it.

Do you see anything jumping out at you? I have attached screenshots of where you can find them.

Thanks,
Bhavya

[anon89617342]

hi, thank you for your reply. the version is Kibana: v 7.9.1.

when I look at the elasticsearch requests and responses, I noticed that it uses Cardinality aggregation to count on all three graphs that was compared and I found that the Counts are approximate.

Cardinality aggregation | Elasticsearch Guide [7.14] | Elastic

do you think the Cardinality aggregation causes the differences between three graphs?
or in addition to this, approximate documents count on Terms aggregation causes this as well?

Terms aggregation | Elasticsearch Guide [7.9] | Elastic