Strange visualisation behaviour with floating point numbers

[smilin_stan (Stan S Stanman)]

I am using the jolokia module in metricbeats which is capturing (amongst other things) the following system stats:

I am trying to graph the maximum CPU idle percentage (the system.cpu.idle.pct field), which is a floating point number which averages 3.99:

However, my graph shows a consistent line of value 1:

Kibana has identified the field as a number, not a string. Does anyone have any ideas what I'm doing wrong?

[Nathan_Reese]

Can you open the inspector for the visualization? What do the request and response look like?

[smilin_stan (Stan S Stanman)]

The request is:

{
  "size": 0,
  "_source": {
	"excludes": []
  },
  "aggs": {
	"2": {
	  "date_histogram": {
		"field": "@timestamp",
		"interval": "1m",
		"time_zone": "Europe/London",
		"min_doc_count": 1
	  },
	  "aggs": {
		"1": {
		  "max": {
			"field": "system.cpu.idle.pct"
		  }
		}
	  }
	}
  },
  "stored_fields": [
	"*"
  ],
  "script_fields": {},
  "docvalue_fields": [
	"@timestamp",
	"system.process.cpu.start_time"
  ],
  "query": {
	"bool": {
	  "must": [
		{
		  "match_all": {}
		},
		{
		  "match_phrase": {
			"component": {
			  "query": "ui"
			}
		  }
		},
		{
		  "exists": {
			"field": "system.cpu.idle.pct"
		  }
		},
		{
		  "range": {
			"@timestamp": {
			  "gte": 1536164633286,
			  "lte": 1536168233286,
			  "format": "epoch_millis"
			}
		  }
		}
	  ],
	  "filter": [],
	  "should": [],
	  "must_not": []
	}
  }
}

Response:

{
  "took": 10,
  "timed_out": false,
  "_shards": {
	"total": 25,
	"successful": 25,
	"skipped": 0,
	"failed": 0
  },
  "hits": {
	"total": 360,
	"max_score": 0,
	"hits": []
  },
  "aggregations": {
	"2": {
	  "buckets": [
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:23:00.000+01:00",
		  "key": 1536164580000,
		  "doc_count": 1
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:24:00.000+01:00",
		  "key": 1536164640000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:25:00.000+01:00",
		  "key": 1536164700000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:26:00.000+01:00",
		  "key": 1536164760000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:27:00.000+01:00",
		  "key": 1536164820000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:28:00.000+01:00",
		  "key": 1536164880000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:29:00.000+01:00",
		  "key": 1536164940000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:30:00.000+01:00",
		  "key": 1536165000000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:31:00.000+01:00",
		  "key": 1536165060000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T17:32:00.000+01:00",
		  "key": 1536165120000,
		  "doc_count": 6
		},
		
		<.... snip ....>
		
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:14:00.000+01:00",
		  "key": 1536167640000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:15:00.000+01:00",
		  "key": 1536167700000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:16:00.000+01:00",
		  "key": 1536167760000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:17:00.000+01:00",
		  "key": 1536167820000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:18:00.000+01:00",
		  "key": 1536167880000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:19:00.000+01:00",
		  "key": 1536167940000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:20:00.000+01:00",
		  "key": 1536168000000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:21:00.000+01:00",
		  "key": 1536168060000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:22:00.000+01:00",
		  "key": 1536168120000,
		  "doc_count": 6
		},
		{
		  "1": {
			"value": 1
		  },
		  "key_as_string": "2018-09-05T18:23:00.000+01:00",
		  "key": 1536168180000,
		  "doc_count": 5
		}
	  ]
	}
  },
  "status": 200
}

[Nathan_Reese]

Looks like the request includes the query ui. Maybe this is filtering out documents with higher values? Try the request in the dev-tools application and set size to 100 so you can see some of the documents that are getting used for the aggregation.

"match_phrase": {
  "component": {
    "query": "ui"
  }
 }

[smilin_stan (Stan S Stanman)]

Thanks! I can see that many were being filtered out, my bad, the maximum is actually below:

So it's 1.9 instead of 3.9. How come the values being returned in the visualization are integers and not floats?

[Nathan_Reese]

What is the mapping for field system.cpu.idle.pct? Under Management -> Index Pattern? What field formatter is being used for that field?

[smilin_stan (Stan S Stanman)]

The mapping is set to number. The field format is the default (I haven't changed/customised it) and this is set to number also:

[Nathan_Reese]

What is the field mapping in elasticsearch?

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html

[smilin_stan (Stan S Stanman)]

Thank you!

The mapping in ES was set to long and not float. I have created an index template:

      "percentages_as_float": {
        "mapping": {
          "type": "float"
        },
        "match": "pct",
        "match_mapping_type": "*"
      }

I created a new index and now it's working fine!

I was a bit thrown because I could see floats in Kibana; I thought ES must be storing them as floats because they'd be truncated as ints otherwise. I guess not!