Kibana Discover and Visualization screen is not showing correct results for the values provided via filters

[Mohitj252 (Mohit Jain)]

Hi,

I have few queries related to discover page and visualization page. I am trying to explain the different scenarios which I observed.

Scenario 1.
In the discover screen, there are counter values (counter_value is a field) having floating point values (for eg 0.5, 10.5, 21.4).

When trying to apply filter with condition "counter_value is not 0.04" (table contains values 0.04), it should not show counter values 0.04 in the result table but it is showing.

Please see attached pictures

Scenario 2.
In the discover screen, I added the filter (counter_value is 21.xx (floating value greater than 1)), in the result nothing is coming PFA screenshot.

Scenario 3
In the Visualization screen, for the counter_value is 21.xx, I can see the value 21 (looks like it round off the value) on the graph. PFA screenshot.

Summary

1. Regarding visualization page, It will round off all the values, for eg if it is 21.04, then it will round off to 21, and then it will show on the graph. Please correct me if I am wrong.
2. Regarding Discover page, it is not showing results for (counter_value is x.xx), and it is showing value x.xx in the table for a case where I am mentioning, it should not show that value (counter_value is not 0.04). Please guide me to understand the exact behaviour of the discover and visualization page or does it is a bug with Kibana?

[flash1293 (Joe Reuter)]

Please check your mapping to confirm, but this sounds like counter_value is mapped as an integer field (long, integer, short, byte or unsigned_long), but actually contains values including a decimal point. Visualizations are based on aggregations, so they just work with the indexed value (which is rounded to the nearest integer), but Discover is looking at the _source object (the originally ingested JSON object) which includes the original value including the decimal point. The filter doesn't work though because it is relying on the indexed value again.

To fix this, you need to change the mapping (e.g. by using double for this field) and then re-index your data, so Elasticsearch can build a new index based on the floating point number.