@formiaczek sorry for the delay in responding. I unfortunately don't have a definitive answer, but a teammate pointed me to a relevant discussion here: https://github.com/elastic/kibana/issues/17532#issuecomment-465452130
When using split series, he mentions that the sort order is determined by the ordering of the first aggregation that comes back from Elasticsearch.
In the demo link you provided above, I can see the following:
Screenshot for reference, showing error appearing first, even though it's not the "smallest" by count:
Request to Elasticsearch
{
"aggs": {
"2": {
"terms": {
"field": "tags.keyword",
"order": {
"_count": "asc"
},
"size": 7
},
"aggs": {
"3": {
"terms": {
"field": "machine.os.keyword",
"order": {
"_count": "desc"
},
"missing": "__missing__",
"size": 8
}
}
}
}
},
"size": 0,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {
"hour_of_day": {
"script": {
"source": "doc['timestamp'].value.getHourOfDay()",
"lang": "painless"
}
}
},
"docvalue_fields": [
{
"field": "timestamp",
"format": "date_time"
},
{
"field": "utc_time",
"format": "date_time"
}
],
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"range": {
"timestamp": {
"format": "strict_date_optional_time",
"gte": "2020-05-06T11:49:53.540Z",
"lte": "2020-05-13T11:49:53.540Z"
}
}
}
],
"should": [],
"must_not": []
}
}
}
Response from Elasticsearch
{
"took": 4,
"timed_out": false,
"_shards": {
"total": 1,
"successful": 1,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 1701,
"max_score": null,
"hits": []
},
"aggregations": {
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "ios",
"doc_count": 24
},
{
"key": "win 8",
"doc_count": 19
},
{
"key": "win xp",
"doc_count": 19
},
{
"key": "osx",
"doc_count": 15
},
{
"key": "win 7",
"doc_count": 11
}
]
},
"key": "error",
"doc_count": 88
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "win xp",
"doc_count": 29
},
{
"key": "ios",
"doc_count": 16
},
{
"key": "osx",
"doc_count": 16
},
{
"key": "win 7",
"doc_count": 15
},
{
"key": "win 8",
"doc_count": 14
}
]
},
"key": "login",
"doc_count": 90
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "win xp",
"doc_count": 37
},
{
"key": "win 8",
"doc_count": 34
},
{
"key": "win 7",
"doc_count": 27
},
{
"key": "ios",
"doc_count": 24
},
{
"key": "osx",
"doc_count": 24
}
]
},
"key": "warning",
"doc_count": 146
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "win xp",
"doc_count": 66
},
{
"key": "win 8",
"doc_count": 63
},
{
"key": "osx",
"doc_count": 60
},
{
"key": "win 7",
"doc_count": 53
},
{
"key": "ios",
"doc_count": 51
}
]
},
"key": "security",
"doc_count": 293
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "win xp",
"doc_count": 349
},
{
"key": "ios",
"doc_count": 255
},
{
"key": "osx",
"doc_count": 240
},
{
"key": "win 8",
"doc_count": 240
},
{
"key": "win 7",
"doc_count": 234
}
]
},
"key": "info",
"doc_count": 1318
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "win xp",
"doc_count": 388
},
{
"key": "osx",
"doc_count": 277
},
{
"key": "ios",
"doc_count": 274
},
{
"key": "win 7",
"doc_count": 264
},
{
"key": "win 8",
"doc_count": 264
}
]
},
"key": "success",
"doc_count": 1467
}
]
}
}
}
In the response that Kibana receives from Elasticsearch, we see that the outer aggregation (aggregating on tags.keyword) is sorted by count, ascending. This count is across all sub-buckets (machine.os.keyword). If we take out the details of the sub-aggs, we indeed see that the outer aggregation is sorted correctly, and reflects the order that we see rendered in the chart and legend.
{
"aggregations": {
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "error",
"doc_count": 88
},
{
"key": "login",
"doc_count": 90
},
{
"key": "warning",
"doc_count": 146
},
{
"key": "security",
"doc_count": 293
},
{
"key": "info",
"doc_count": 1318
},
{
"key": "success",
"doc_count": 1467
}
]
}
}
}
So even though error is not the smallest bucket in the all of the sub-buckets, when you look at error across all sub-buckets, it has the smallest count relative to all others. So it is possible for outliers in the data to alter the way the buckets are sorted, which in turn impacts the way Kibana renders the visualization.
the original comment). That's the best way to make sure the right folks see it, and watching +1s helps us to best prioritize. In the meantime, I'll ping the team that works in this area to make sure it's still being monitored.