Kibana unique count more that number of records

Elastic Stack Kibana
1

hi everyone

I´m using kibana dashboards, and when I try to add a metric with unique count to select all uniques the number of uniques is not the same that the number of records that I have, for example in my index I've 52727 records but when I do the metric with unique count the result that I´ve is 52903, and I don´t know why, Isn´t problem of data the field that I´m using exist in each record, it doesn´t have spaces or any character that can be part of the problem, in fact is an UUID

hope you can help me

2

Hi @erickhillo Welcome to the community

Can you show the exact commands and the results you ran that resulted in these results? Otherwise we can't help :slight_smile:

3 
GET example/_search
{
  "size": 0, 
  "_source": false, 
  "query": {
    "match": {
      "comprobante_type":"comprobantes"
    }
  },
  "aggs": {
    "Total_unique": {
      "cardinality": {
        "field": "myfieldhere"
        }
      }
  }
}

this is my query and I got this result

},
  "aggregations": {
    "total_unique": {
      "value": 72903
    }
  }
}

but in my discover I've these result with same filters

image
image844×368 24.6 KB

4

What version of Elasticsearch and Kibana is that?

Also one has a time frame and other does not?

What is the query in discover?

Also you should probably use a term query if the type is keyword

You can also look at inspect to see the query from Kibana...

5

I'm using kibana 8.13.3 same elasticsearch, no it's the total of record time doesn't matter

this is the query

"query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "range": {
            "cfdi:Comprobante.@Fecha": {
              "format": "strict_date_optional_time",
              "gte": "2019-05-07T23:58:19.815Z",
              "lte": "2024-05-08T00:58:19.815Z"
            }
          }
        },
        {
          "match_phrase": {
            "comprobante_type": "comprobantes"
          }
        }
      ],
      "should": [],
      "must_not": []
    }

as you can see I've dates but it's last 5 year and I dont have documents beyond 2 or 3 years

6

sorry for late response a lot of work, hope someone can help me