# Kibana average\_bucket , max\_bucket and min\_bucket shows invalid results

**URL:** https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675
**Category:** Kibana
**Created:** [August 2, 2018, 4:37am UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675 "2018-08-02T04:37:00Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Manoj\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)
#### Post date: [August 2, 2018, 4:37am UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/1 "2018-08-02T04:37:00Z")

</div>

In my system, I am using Filebeat, Logstash, Elasticsearch, and Kibana.  
For every transaction in the system, a log is printed in the log file and it is saved in the Elasticsearch db.

Sample logline: **TID: [-1234] [] [2018-08-02 09:53:36,629] INFO {org.apache.synapse.mediators.builtin.LogMediator} - API Request URL = /payment/v1/947032456/transactions/amount/, Request ID = 901fef70f925, API = Payment, Application Name = Payment, User Name = MMS\_NEW {org.apache.synapse.mediators.builtin.LogMediator}**

In Kibana I'm using this data to generate a data table visualization with has user, api, app, average tps, min tps and max tps.

1. The expectation of average tps is to get the average transactions per second considering the selected time interval.

2. The expectation of max tps is to get the maximum transactions happened in a second within the selected time interval.

3. The expectation of max tps is to get the minimum transactions to happen within the selected time interval.

But the results do not show correct results.  
Ex: if we want to calculate the average tps within a 1 minute and i there are only 20 transactions within that time period we expect the average value to be 20/60

We suspect these invalid results are due to gaps in transactions ( no transactions available in every second ). The request sent by Kibana is as follows. Plese, help.

{  
"size": 0,  
"\_source": {  
"excludes": []  
},  
"aggs": {  
"2": {  
"terms": {  
"field": "username.keyword",  
"size": 100,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"3": {  
"terms": {  
"field": "api.keyword",  
"size": 100,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"4": {  
"terms": {  
"field": "appname.keyword",  
"size": 100,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"1": {  
"avg\_bucket": {  
"buckets\_path": "1-bucket\>\_count",  
"gap\_policy": "insert\_zeros"  
}  
},  
"5": {  
"max\_bucket": {  
"buckets\_path": "5-bucket\>\_count"  
}  
},  
"6": {  
"min\_bucket": {  
"buckets\_path": "6-bucket\>\_count"  
}  
},  
"1-bucket": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "5s",  
"time\_zone": "Asia/Katmandu",  
"min\_doc\_count": 0  
}  
},  
"5-bucket": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "5s",  
"time\_zone": "Asia/Katmandu",  
"min\_doc\_count": 0  
}  
},  
"6-bucket": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "5s",  
"time\_zone": "Asia/Katmandu",  
"min\_doc\_count": 0  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"version": true,  
"stored\_fields": [  
"_"  
],  
"script\_fields": {},  
"docvalue\_fields": [  
"@timestamp"  
],  
"query": {  
"bool": {  
"must": [{  
"match\_all": {}  
},  
{  
"match\_all": {}  
},  
{  
"range": {  
"@timestamp": {  
"gte": 1533181623220,  
"lte": 1533182523220,  
"format": "epoch\_millis"  
}  
}  
}  
],  
"filter": [],  
"should": [],  
"must\_not": []  
}  
},  
"highlight": {  
"pre\_tags": [  
"@kibana-highlighted-field@"  
],  
"post\_tags": [  
"@/kibana-highlighted-field@"  
],  
"fields": {  
"_": {}  
},  
"fragment\_size": 2147483647  
}  
}

---

<div class="post-metadata">

### Author: ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [August 6, 2018, 2:40pm UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/2 "2018-08-06T14:40:33Z")

</div>

Can you be more specific about what you are seeing? What invalid result are you getting?

---

<div class="post-metadata">

### Author: ![Manoj\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)
#### Post date: [August 7, 2018, 4:49am UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/3 "2018-08-07T04:49:40Z")

</div>

For example:

When I need to find the average tps within the last 15 minutes I got the following results.

There was a total of 8 transactions within the 15 min time period.  
So expected average tps should be 8/(15\*60) = 0.0088  
But the received result is 0.016

Why am I getting that result?  
Is it because of a fault in my logic or am I using the average\_bucket for the wrong purpose?

Please help.

---

<div class="post-metadata">

### Author: ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)
#### Post date: [August 7, 2018, 1:52pm UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/4 "2018-08-07T13:52:25Z")

</div>

Based on the math of the above example, I would assume that what is going on is that it is only counting the minutes where a transaction occurred, so you wind up with 8/(8\*60) = 0.016. I see that you are using gap\_policy insert\_zeros, but I think that only inserts missing values not missing documents. I would suggest that you ask this question in the Elasticsearch forum as this is really a question about the search DSL. Sorry I could not be of more help.

---

<div class="post-metadata">

### Author: ![Manoj\_Hettiarachchi](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Manoj\_Hettiarachchi](https://discuss.elastic.co/u/Manoj_Hettiarachchi)
#### Post date: [August 8, 2018, 9:52am UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/5 "2018-08-08T09:52:06Z")

</div>

Ok, I will ask this question in Elasticsearch forum.  
Thank you for the help.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2018, 9:54am UTC](https://discuss.elastic.co/t/kibana-average-bucket-max-bucket-and-min-bucket-shows-invalid-results/142675/6 "2018-09-05T09:54:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
