Kibana is showing two different values for a field?

[Yaswanth]

Hi,

I have some data in which i am finding sum of balances from particular state.

Here in the visualization it is showing some values. But i clicked on one state field TX it is showing correct value like this. I also cross checked the same in ES by writing a query.

Why i am getting wrong values on the first image then getting correct ones after clicking on the field?

Thanks

[jbudz (Jon Budzenski)]

Are documents being ingested / is there a timestamp that may be causing documents to go out of scope?

Can you share the queries in the request tab?

[Yaswanth]

The documents are already ingested. I think the problem is not with timestamp since i am not using this field in the visualization .
The request of the above query is like this:

{
  "size": 0,
  "query": {
    "query_string": {
      "query": "*",
      "analyze_wildcard": true
    }
  },
  "aggs": {
    "2": {
      "terms": {
        "field": "state.raw",
        "size": 5,
        "order": {
          "1": "desc"
        }
      },
      "aggs": {
        "1": {
          "sum": {
            "field": "balance"
          }
        }
      }
    }
  }
}

Thanks

[jbudz (Jon Budzenski)]

Making sure I understand everything correctly:

• The first picture displays incorrect sums
• The second picture, after adding a filter for for state.raw, has correct sums
• The query you wrote in es has the correct counts

It looks like you shared the query of the first picture, can you share the query of the second picture too? What version of es/kibana are you on? I may need to move this over to the elasticsearch forum - on first glance I'm not sure what could be causing this.

[Yaswanth]

Hi,

I am using Kibana 4.6.4
This is query for the second screenshot:

{
  "took": 8,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 30,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "2": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "1": {
            "value": 782199
          },
          "key": "TX",
          "doc_count": 30
        }
      ]
    }
  }
}

Thanks