# Kibana showing wrong histogram interval in output

**URL:** <https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [May 13, 2018, 12:07pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614 "2018-05-13T12:07:01Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 13, 2018, 12:07pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/1 "2018-05-13T12:07:01Z")

</div>

I am creating query for histogram output of metricbeat cpu log.

i tried this query as below.

```
post metricbeat/_search
{ "size": 0,       
"query" : {
  "bool": { "must": 
    [  
    { "range": { "@timestamp": { "gte": "05-03-2018", "lte": "05-03-2018", "format": "MM-dd-yyyy" } }} ,    
    { "range": { "system.cpu.system.pct": { "gte":"0.0", "lte":"2.0" } }}, {"match": {
      "metricset.name.keyword": "cpu"
    }}
  ]
}
},
  "aggs": { "count":{ "date_histogram": {"field": "@timestamp", "interval": "1d","format" : "MM-dd-yyyy","min_doc_count": 1 },
                "aggs": {
                   "PctVal": { "histogram":{"field": "system.cpu.system.pct", "interval": "0.25","min_doc_count": 0}}
                }
    
    }
  }}

```

result i got as below

> ```
> {
> "took": 12,
> "timed_out": false,
> "_shards": {
> "total": 5,
> "successful": 5,
> "skipped": 0,
> "failed": 0
> },
> "hits": {
> "total": 7307,
> "max_score": 0,
> "hits": []
> },
> "aggregations": {
> "count": {
> "buckets": [
> {
> "key_as_string": "05-03-2018",
> "key": 1525305600000,
> "doc_count": 7307,
> "PctVal": {
> "buckets": [
> {
> "key": 0,
> "doc_count": 7304
> },
> {
> "key": 0.25,
> "doc_count": 0
> },
> {
> "key": 0.5,
> "doc_count": 0
> },
> {
> "key": 0.75,
> "doc_count": 0
> },
> {
> "key": 1,
> "doc_count": 3
> }
> ]
> }
> }
> ]
> }
> }
> }
> 
> ```

- i got all values between 0 and 1 as zero. why is tht ? it's a float value field.
- There is values i know that. i saw in kibana.
- Somehow system.cpu.system.pct field is taking as integer not as float.
- I am using metricbeat default config file and system module

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 14, 2018, 8:21am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/2 "2018-05-14T08:21:17Z")

</div>

What version of metricbeat are you using?  
Did you run the [metricbeat setup](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html) before starting to send metrics? You need to do it to have the correct mappings for your fields.

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 14, 2018, 11:51am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/3 "2018-05-14T11:51:48Z")

</div>

i am using 6.2.4 version of ELK  
config file as like below

```
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  `# Array of hosts to connect to.`
  hosts: ["localhost:9200"]
  index: "metricbeat"

#========================== Modules configuration ============================

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression

setup.template.name: "metricbeat"
setup.template.fields: "fields.yml"
setup.template.pattern: "metricbeat-*"

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
```

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 21, 2018, 10:16am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/4 "2018-05-21T10:16:40Z")

</div>

Please help anybody ?  
how can i solve it?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 22, 2018, 8:57am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/5 "2018-05-22T08:57:28Z")

</div>

Did you run [metricbeat setup](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html)?

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 22, 2018, 10:58am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/6 "2018-05-22T10:58:42Z")

</div>

what do you mean by metric beat setup ?

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 22, 2018, 11:05am UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/7 "2018-05-22T11:05:52Z")

</div>

i change configuration yml file like above then loaded template manually using powershell

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 22, 2018, 12:26pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/8 "2018-05-22T12:26:14Z")

</div>

Ok, let's check then the type in the mapping of this field, make this request from Kibana developer console:

```auto
GET /metricbeat-6.2.4-*/_mapping/field/system.cpu.system.pct

```

You should get something like:

```auto
{
  "metricbeat-6.2.4-2018.05.22": {
    "mappings": {
      "doc": {
        "system.cpu.system.pct": {
          "full_name": "system.cpu.system.pct",
          "mapping": {
            "pct": {
              "type": "scaled_float",
              "scaling_factor": 1000
            }
          }
        }
      }
    }
  }
}

```

The type should be `scaled_float`.

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 22, 2018, 3:05pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/9 "2018-05-22T15:05:28Z")

</div>

```
{
  "metricbeat": {
    "mappings": {
      "doc": {
        "system.cpu.system.pct": {
          "full_name": "system.cpu.system.pct",
          "mapping": {
            "pct": {
              "type": "long"
            }
          }
        }
      }
    }
  }
}

```

i got as long  
how can i change it ?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 22, 2018, 3:16pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/10 "2018-05-22T15:16:00Z")

</div>

Maybe the problem is in the template name, you configured the setup with template pattern `metricbeat-*`, but your elasticsearch output is storing events in the `metricbeat` index, that doesn't match the pattern of the template, so even if the setup was done, the mapping is not being applied.

I'd recommend to use the default index names. Is there any reason you need to change them?

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 23, 2018, 2:26pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/11 "2018-05-23T14:26:52Z")

</div>

default index name contain timestamp, i don't need it  
That's why i change index

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 23, 2018, 2:48pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/12 "2018-05-23T14:48:07Z")

</div>

Having time-based index names is useful, for example if you want to remove old data you can just remove old indexes, also if you want to move old data to masters with slower disks ([the hot-warm architecture](https://www.elastic.co/blog/hot-warm-architecture)), you can just move the old indexes.  
Default indexes also have version information, this is also important as Beats of different versions may send events with different type mappings.

---

<div class="post-metadata">

**Author:** ![varun1992](https://avatars.discourse-cdn.com/v4/letter/v/3da27b/32.png) [@varun1992](https://discuss.elastic.co/u/varun1992)\
**Post date:** [May 25, 2018, 12:57pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/13 "2018-05-25T12:57:08Z")

</div>

ok thanks for help.

Is there a way to update template of an index after adding data ?  
like chenging from number to float ?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 25, 2018, 2:37pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/14 "2018-05-25T14:37:56Z")

</div>

It is not possible to update the types of existing data, for that you need to create a new index and the proper mappings, and [reindex](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html).  
In your case, if you want to keep your existing data you can try to directly reindex from your `metricbeat` index to an index whose name matches with the template pattern. And for new data I'd recommend to use the default names and patterns.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2018, 2:37pm UTC](https://discuss.elastic.co/t/kibana-showing-wrong-histogram-interval-in-output/131614/15 "2018-06-22T14:37:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.