Kibana bar chart inaccurate when searching on field? [SOLVED]


(Chris) #1

I'm seeing an issue with bar chart values when searching on a field. The bar chart values are accurate when there is nothing in the search field, but when I search for field:"xyz", the numbers in the bars are close but not exactly correct. If I then add that field to the aggregation by slicing the bars by it, the numbers are exactly correct.

Anyone else seeing this behavior?


(Mark Walkom) #2

What sort of agg are you using?


(Chris) #3

I'm using unique count.


(Chris) #4

There is no inaccuracy, this was an error in my testing. Sorry about that!


(Mark Walkom) #5

What was the error?


(Chris) #6

Purely a user error. I didn't fully understand the data until I dug into it using the Kibana table visualization.

In short, this is the gist of what I was doing...

  1. Bar charts on unique count of a uid field, search on *, total was 15.
  2. Bar charts on unique count of a uid field, search on type_field:type_value, total was 3.
  3. Bar charts on unique count of a uid field, search on NOT type_field:type_value, total was 14.

At first I was expecting the second two queries to add up to 15.

However, I later realized that the uid field was not unique in the index and there were a couple of uids that had a record with the type_value and another without the type_value. Pretty obvious in hindsight.


(Mark Walkom) #7

All good, it's useful for people to know how you solved it though as someone else might run into it.
Same goes for not editing the topic, better to put something like [SOLVED] there :slight_smile:


(system) #8