# Strange behaviour when counting events in bar chart **URL:** \ **Category:** Kibana\ **Created:** [June 1, 2016, 9:44am UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537 "2016-06-01T09:44:54Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 1, 2016, 9:44am UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/1 "2016-06-01T09:44:54Z")
Hi I want to create a vertical bar chart visualisation where I count the number of events depending to event timestamp, and I notice a behavior that does not understand. My event time field is called ACT\_HEURE\_ACTIVITE. My time dimension spreads from 2th of may 00:00:00 to 3th of may 00:00:00. When I set my Y-axis agregation to Count Kibana returns 102 ivents. Same if I change to Unique count using INC\_ID field (which is a unique ID). ![](https://us1.discourse-cdn.com/elastic/original/2X/4/43a13a4dbbe77c619092705ba38fe892bd646c9f.PNG) When I let my Y-axis agregation to Count mode and set my X-axis to Date Histogram using ACT\_HEURE\_ACTIVITE and daily interval, Kibana still returns 102 events. ![](https://us1.discourse-cdn.com/elastic/original/2X/f/ff1cf826683a0eb2ff36ffc23104e447a25bba35.PNG) But when I change my Y-axis agregation to Unique Count using INC\_ID field the system returns 100 events... ![](https://us1.discourse-cdn.com/elastic/original/2X/7/70fa2617de36d1cb538fe55cedc0870c73c048b2.PNG) And I change the Y-axis field to ACT\_HEURE\_ACTIVITE Kibana returns 103 events ! Could anyone explain this behaviour? ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [June 2, 2016, 10:56pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/2 "2016-06-02T22:56:17Z")
What count does the Discover tab show for that time range? I think that would be the most accurate count of docs since it isn't doing any aggregations. ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 3, 2016, 7:37am UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/3 "2016-06-03T07:37:27Z")
102 events ![](https://us1.discourse-cdn.com/elastic/original/2X/c/cd8cc94509585a773a2dd02971902e6bdb88e0e2.PNG) ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [June 3, 2016, 2:09pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/4 "2016-06-03T14:09:05Z")
So it seems you must have 102 documents in that time range. > [@kruelah](#): > > But when I change my Y-axis agregation to Unique Count using INC\_ID field the system returns 100 events... But it seems that either 3 documents have the same INC\_ID, or 2 pairs of documents have the same INC\_ID such that there's only 100 unique INC\_IDs. On the Discover tab you could add the INC\_ID field to the table and sort by that to try to see the duplicates. > And I change the Y-axis field to ACT\_HEURE\_ACTIVITE Kibana returns 103 events ! You don't show a screen shot of this last combination. I don't know why you would see a count of 103. But I can't think of any reason to use the timestamp on both the X and Y Axis. Another way to find the duplicates might be to follow the example in this screen shot and put JSON in the advanced JSON Input field (except you would use `{ "min_doc_count":2}` and that should show you only the duplicate INC\_IDs. ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5b56aeb1944dfba882f271df4772ff3d911481ca.png) ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 3, 2016, 3:22pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/5 "2016-06-03T15:22:14Z")
> [@LeeDr](#): > > But it seems that either 3 documents have the same INC\_ID, or 2 pairs of documents have the same INC\_ID such that there's only 100 unique INC\_IDs. On the Discover tab you could add the INC\_ID field to the table and sort by that to try to see the duplicates. I added the INC\_ID field in Discover tab and exported data to Excel (copy-paste values). My sheet containts 102 lines. When I remove duplicates on INC\_ID column I also obtain 102 distinct values. > [@LeeDr](#): > > You don't show a screen shot of this last combination. I don't know why you would see a count of 103. But I can't think of any reason to use the timestamp on both the X and Y Axis. This is the result: ![](https://us1.discourse-cdn.com/elastic/original/2X/8/8458a2809d5c748b31967f1693939f7d539e7b20.PNG) Indeed there is no reason to use timestamp on Y-axis as well. My goal was to use another unique field and check the agregation function. > [@LeeDr](#): > > Another way to find the duplicates might be to follow the example in this screen shot and put JSON in the advanced JSON Input field (except you would use { "min\_doc\_count":2} and that should show you only the duplicate INC\_IDs. I also tried to follow your example but I think I do something wrong because I don't obtain expected result. ![](https://us1.discourse-cdn.com/elastic/original/2X/c/c9fc779d9379c92645e989ce0bd9d49e94fe7882.PNG) Any idea? ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [June 3, 2016, 4:19pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/6 "2016-06-03T16:19:27Z")
I think on the min\_doc\_count part you should trying changing "Date Histogram" to "Terms" and change "Field" to INC\_ID ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 6, 2016, 7:22am UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/7 "2016-06-06T07:22:54Z")
I set my visualization as said and obtain a "No results found" message. ![](https://us1.discourse-cdn.com/elastic/original/2X/8/85e5e90664911e12ae27528e3aa01b3932bdc0c5.PNG) ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 6, 2016, 1:10pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/8 "2016-06-06T13:10:59Z")
I set up a new basic testing environement using following scripts to create index and mapping, and import datas. [https://www.wetransfer.com/downloads/0e2cb9930e37a56a7504ba70160e295d20160606123941/9e3c84](https://www.wetransfer.com/downloads/0e2cb9930e37a56a7504ba70160e295d20160606123941/9e3c84) Data file contains 324 events which concerns only the 2th of may 2016. As you can see my new index contains 324 documents. ![](https://us1.discourse-cdn.com/elastic/original/2X/3/30922ae0b6a19891eb2e233bbb740c4d57ae10d9.PNG) The mapping has following structure: ![](https://us1.discourse-cdn.com/elastic/original/2X/5/585ec14f9e6b93e618001a0a2822534f688158d5.PNG) ![](https://us1.discourse-cdn.com/elastic/original/2X/7/728c795858d10f216c837ab8ecab66d66bae0dc5.PNG) Events are displayed in Discover tab: ![](https://us1.discourse-cdn.com/elastic/original/2X/9/9032a6efe2430553bc3f202bf1c909c7ccd525cd.PNG) I obtain 324 results when I agregate my data by date histogram on ACT\_ACTIVITY\_TIME field. ![](https://us1.discourse-cdn.com/elastic/original/2X/2/21938a28f1d91f6cc247be60e66c5258d861d446.PNG) But if I choose to set my metric agregation type to unique count I obtains 335 results... ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d52cc7c1f7738b07a8976a3e804fa70a99c0a825.PNG) Note that I obtain differents results depending to the field I choose. ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [June 6, 2016, 2:17pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/9 "2016-06-06T14:17:40Z")
Your last screenshot has a time range of 'Last 60 days'. I think you meant for that to be only the 2nd of May 2016. Do you get 324 if you set it to only that day? ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [June 13, 2016, 1:21pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/10 "2016-06-13T13:21:15Z")
I still obtain 335 results if I set the time range from 2nd to 3rd of may and choose a daliy custom interval. ![](https://us1.discourse-cdn.com/elastic/original/2X/9/925ab477a0480e2e53cfa2014bade09efa6993f2.PNG) In my previous post I didn't set time range because elasticsearch index only contains events data that occured the 2nd of may. ---
**Author:** ![kruelah](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Post date:** [July 5, 2016, 7:21am UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/11 "2016-07-05T07:21:52Z")
Any idea? ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [July 21, 2016, 5:41pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/12 "2016-07-21T17:41:38Z")
I started looking into this again. One thing to look at is this; [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#\_counts\_are\_approximate](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-metrics-cardinality-aggregation.html#_counts_are_approximate) I don't see the `precision_threshold`specified in the request for a visualization with `unique count` used so I guess it uses the default. The default value is described here, but don't make complete sense to me; `Default value depends on the number of parent aggregations that multiple create buckets (such as terms or histograms).` I also tried a test with test data I had, and when I charted unique count of a time field I also got many more results than I expected. But then I found that the time field represented an array and some docs had multiple time values in them. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/strange-behaviour-when-counting-events-in-bar-chart/51537/13 "2017-07-06T13:45:06Z")