# Kibana not aggregating on large values of a field

**URL:** <https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172>\
**Category:** Kibana\
**Created:** [May 1, 2018, 11:56pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172 "2018-05-01T23:56:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Harsh\_Verma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh_verma/32/26136_2.png) [@Harsh\_Verma](https://discuss.elastic.co/u/Harsh_Verma)\
**Post date:** [May 1, 2018, 11:56pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/1 "2018-05-01T23:56:59Z")

</div>

I am using Kibana 5.5.2 and Elasticsearch version 5.5 (on AWS)  
I am trying to generate pie chart and trying to add a sub bucket based on Terms aggregation of a field. I find that if the value of the field is bigger than a limit, the aggregation returns no result.  
and my pie chart looks like this as a result:

 ![17%20PM](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d2b500bff2de60f31aa43f1c397390d81a12ece0.jpg)

As you can see the missing sector is there because aggregation didn't return anything for those buckets. The value of the field where aggregation is not returning anything is something like: `org.dummy.common.DummyException: Failed to deserialize object of type org.dummy.datamodel.DummyModel from file /root/workdir/directory/Name/subdirectory/objectname/package/abc.def -> at org.dummy.main.deserializeObject.deserializeObjectClass(deserializeClassObject.java:213)`

on the other hand values like   
`org.dummy.common.DummyException: Object with name: 'dummyexample' already exists -> at org.dummy.processwork.Manager.operation(ProcessMgr.java:1234)`  
are being aggregated and show as can be seen in the pie chart.  
Any help guys ?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [May 2, 2018, 12:04pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/2 "2018-05-02T12:04:23Z")

</div>

Hey @Harsh_Verma can you check your index mappings for that field, specifically the [ignore\_above](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/ignore-above.html) setting? Are the strings that aren't showing up above that character limit?

---

<div class="post-metadata">

**Author:** ![Harsh\_Verma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh_verma/32/26136_2.png) [@Harsh\_Verma](https://discuss.elastic.co/u/Harsh_Verma)\
**Post date:** [May 2, 2018, 3:21pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/3 "2018-05-02T15:21:54Z")

</div>

@Brandon_Kobel, yes it is set to 256, and the string I am trying to aggregate is 264 . How can I change it ? Although I am able to see fields of any length in the Discover tab, just the visualize tab ignores them

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [May 2, 2018, 5:49pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/4 "2018-05-02T17:49:22Z")

</div>

The Discover tab will display the entire source document, so that's why you're seeing that string there.

Per [ignore\_above | Elasticsearch Reference [5.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/ignore-above.html)

> Its value can be updated on existing fields using the PUT mapping API.

> **[Put Mapping | Elasticsearch Reference \[5.5\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-put-mapping.html)**

---

<div class="post-metadata">

**Author:** ![Harsh\_Verma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harsh_verma/32/26136_2.png) [@Harsh\_Verma](https://discuss.elastic.co/u/Harsh_Verma)\
**Post date:** [May 2, 2018, 6:59pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/5 "2018-05-02T18:59:59Z")

</div>

@Brandon_Kobel, so if I update the ignore\_above value for a field, will Elasticsearch retroactively index the documents containing the field that are already stored ? So that my pie-chart starts showing the missing values ?

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [May 2, 2018, 8:43pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/6 "2018-05-02T20:43:54Z")

</div>

You’ll have to reindex your data with the new setting to retroactively fix your data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2018, 8:44pm UTC](https://discuss.elastic.co/t/kibana-not-aggregating-on-large-values-of-a-field/130172/7 "2018-05-30T20:44:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
