Kibana size parameter in split bar visualizations

[wokmichel]

Hello,
I am having trouble understanding how Kibana 5.0 handles the size parameter in term aggregations for split bar charts.

As an example, have a look here :

The size parameter is set to 10 but the graphs shows way more fields :

When set to 3, the amount of processes shown is still correct but it goes hayward from 4 on :

• With 3 :

• With 4 :
  
  

Am I missing something or is that the expected behavior ?
Anyway, thank you very much, in advance, for your help

(Edited for typos)

[tsullivan (Tim Sullivan)]

The query created in this visualizations asks, for each 30s interval from now back to 15 minutes ago, get me the 10 processes that had the highest CPU usage percentage. It's not always the same 10 processes for each interval.

When you change it to Size: 3, the data only has processes that fight for 1st-3rd place in top CPU usage. For 4th place and lower, there are a lot of processes that have similar CPU usages that interchange their ranking from one interval to the next.

You can see the actual query and result in the Spy panel, by clicking the little upward-caret icon below the visualization.

The JSON in the "Response" tab shows which processes were the top 10 for each interval. You can also copy the JSON from the "Request" tab and get the query created by Kibana.

[wokmichel]

@tsullivan, sorry for being so long to reply.
This explains the noticed behavior.
Thanks a lot