In lens breakdown, the "others" is not an accumulated value

Elastic Stack Kibana
1

Setup: set of servers that sends filesystem metrics with metricbeat.

I'm creating a stacked area visualization in lens with @timestamp on horizontal axis and formula "Maximum" of system.filesystem.used.bytes.

I then break the data down by hostname on top values, grouping the remaining values in "Other".

When I then increase "Number of values" I can observe that the stacked area increase as well.

To my eyes it looks like "Other" != "Remaining valueS" but rather the next maximum or "average of all remaing values" if you chose "Average" instead of "Maximum". Aka the values in the "Other" category is not broken down by the defined field?

Is that correct? And then what is the purpose of "Other"?

  • Bjarne
2

Hi @mekanix ,

Aka the values in the "Other" category is not broken down by the defined field?

Exactly.
Other means that all the remaining hostname are put into a single bucket and the Maximum is computed over the entire group.

The main purpose of Other is to not lose the relationship of the picked values vs the remaining set as a whole. While this can be very useful in partition charts or for operations like Average it can be confusing in some specific scenarios.