Mismatch between Elastic Query Aggretion and Kibana Visualize Function

Hello everyone.
I'm trying create a table that have the same data like the table in Lens Visualization by using the Elasticsearch Query.
I'm confusing cause there's is a different between the data I get by the query and the data in the Visualization.
Please help me!!
Here's the code query I use to get the average data of system.cpu.user.pct in today:

GET metricbeat-*/_search
{
  "size": 0, 
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "system.cpu.user.pct"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now/d",
              "lte": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "avg_memory": {
      "avg": {
        "field": "system.cpu.user.pct"
      }
    }
  }
}

And here is the function in the table to get that data in Lens, notice that I set the same timerange as I used in the query:


The result returns 0.852 meanwhile when I use Elastic Query it returns 0.9846911170688114
That's a huge different between them.

Sorry guys just my mistake.
The range query must be

GET metricbeat-*/_search
{
  "size": 0, 
  "query": {
    "bool": {
      "must": [
        {
          "exists": {
            "field": "system.cpu.user.pct"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-7/d",
              "lte": "now"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "avg_memory": {
      "avg": {
        "field": "system.cpu.user.pct"
      }
    }
  }
}

Cause my time is UTC+7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.