Option for exact aggregation instead of approximation?

Elastic Stack Kibana
1

Kibana ought to have an option to display exact aggregations instead of approximations when returning a subset. In other words, when charting the top 50 results, kibana should be able to request aggregations with a size of 0 and then use only the first 50 buckets returned.

I'm seeing a case where there are three records with the same "key" id, one with a "total_quantity" field value of 5000, another with 1000 and the third with 0. Each record is on a different shard. When I chart in ascending order on the key term and a size of 50, the key shows up with a total_quantity sum of 0 instead of 6000. This is due to each shard only processing the bottom 50 and than reducing the results.

If I use a size of zero, I get accurate results, but the chart is too crowded with data to be useful.

Kibana should have a visualization option (maybe an "exact" checkbox) to query elasticsearch with a size of 0, but then chart only a subset (such as the top or bottom 50). Is this something Kibana will provide, or should I modify the code myself?

2

Perhaps you already know this, but doing a query with size: 0 is the same as not giving it a size at all, which is why you get so many records back. The results you are getting back when using size: 50 is just what comes back from Elasticsearch, and the fact that it isn't what you expected it to be is a limitation of the way it queries your distributed data, but it sounds like you already knew that.

Anyway, I don't believe we have plans to modify the results that come back from Elasticsearch, as in general we try to never do that. But, as this would be an end-user setting, and part of the aggregation, it may be handy to expose, perhaps as an advanced setting.

I'd recommend opening an issue about it and getting some more feedback on the topic, as well as potentially getting some additional support from other users.