# Metric count mismatch in production setup 7.9.0

**URL:** <https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390>\
**Category:** Kibana\
**Created:** [June 9, 2021, 7:39am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390 "2021-06-09T07:39:03Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![abhishek30](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhishek30/32/100065_2.png) [@abhishek30](https://discuss.elastic.co/u/abhishek30)\
**Post date:** [June 9, 2021, 7:39am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/1 "2021-06-09T07:39:04Z")

</div>

Hi,

I have a standalone setup of ELK stack version 7.12.1. in windows machine. I have ingested examination data from csv file to kibana using logstash. Using this data I had to show total students count. I did this using metric visualization as shown below.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3c8d8076529478424948b722dd8aeec533b9d33b.png)  
This gives me the correct count of students. Below is the request for this visualization.

```auto
{
  "aggs": {
    "1": {
      "cardinality": {
        "field": "EEID.keyword"
      }
    }
  },
  "size": 0,
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "exam_date",
      "format": "date_time"
    }
  ],
  "script_fields": {
    "Negative Mark": {
      "script": {
        "source": "0.25",
        "lang": "painless"
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2021-03-11T07:13:49.217Z",
              "lte": "2021-06-09T07:13:49.217Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

```

Now, I also have same standalone production environment with ELK stack version 7.9.0. in centOS machine. I ingested data to production using logstash 7.12.1. I want to create same use case as in my local setup - total count of students. But I am getting count mismatch when using metric visualization.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c72d733c6e4b0dc7d1b4fc9ee8cf3553c322dfa3.png)

The request for above visualization

```auto
{
  "aggs": {
    "1": {
      "cardinality": {
        "field": "EEID.keyword"
      }
    }
  },
  "size": 0,
  "stored_fields": [
    "*"
  ],
  "script_fields": {
    "value_field": {
      "script": {
        "source": "1",
        "lang": "painless"
      }
    }
  },
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "exam_date",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2021-03-11T07:30:34.150Z",
              "lte": "2021-06-09T07:30:34.150Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

```

And when checking the count using data table visualization it gives correct count.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0208ea2ababbb6182920a1b1e3244abca405fc63.png)

Kindly help.

Thank you,  
Regards Abhishek

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [June 9, 2021, 7:43am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/2 "2021-06-09T07:43:12Z")

</div>

Cardinality isn't 100% precise for performance reasons: [Cardinality aggregation | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#_precision_control)

You can use the advanced input to specify the `precision_threshold` to get better values for your use case.

---

<div class="post-metadata">

**Author:** ![abhishek30](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhishek30/32/100065_2.png) [@abhishek30](https://discuss.elastic.co/u/abhishek30)\
**Post date:** [June 9, 2021, 8:22am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/3 "2021-06-09T08:22:03Z")

</div>

Firstly, thank you for such quick response.  
So I tried the precision threshold giving such result.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/b/bbb20762b4ff5c3e280d3c43157b2d087bc9ceb0.png)

But still count mismatch in metric visualization. Below the snapshot and request for the visualization.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/2/12ebd613c7be9ccce0061c751a0a7d178a8ebbb4.png)

```auto
{
  "aggs": {
    "1": {
      "cardinality": {
        "field": "EEID.keyword"
      }
    }
  },
  "size": 0,
  "stored_fields": [
    "*"
  ],
  "script_fields": {
    "value_field": {
      "script": {
        "source": "1",
        "lang": "painless"
      }
    }
  },
  "docvalue_fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "exam_date",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "@timestamp": {
              "gte": "2021-03-11T08:20:24.150Z",
              "lte": "2021-06-09T08:20:24.151Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

```

Kindly Help.  
Thank you

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [June 9, 2021, 8:42am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/4 "2021-06-09T08:42:43Z")

</div>

What I meant is the "Advanced \> JSON input" in the visualization editor:

 ![Screenshot 2021-06-09 at 10.41.46](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c993bb11f1f1482ff7c58a4c6786f901b2b1e4ec.png)

You can put JSON in there and it will be merged with the rest of the request

---

<div class="post-metadata">

**Author:** ![abhishek30](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhishek30/32/100065_2.png) [@abhishek30](https://discuss.elastic.co/u/abhishek30)\
**Post date:** [June 9, 2021, 9:04am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/5 "2021-06-09T09:04:28Z")

</div>

Thank you for the help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2021, 9:05am UTC](https://discuss.elastic.co/t/metric-count-mismatch-in-production-setup-7-9-0/275390/6 "2021-07-07T09:05:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.