Sum aggregation in kibana data table visualization for "other" bucket is always 0

I'm trying to create a data table visualization in ELK 7.8. I have a Terms aggregation with size 5 and checked "Group other values in separate bucket". So it shows Other bucket as row in the table with Count metric. I also have a Sum metric for a numeric field. For this Other bucket, the value of Sum aggregation is always 0 which is not correct. Why is SUM aggregation not performed on "Other" bucket? Are there any ways to achieve this?

Can I have some comment on this please? It sure looks like a gap to me.

Hi @webstruck -- what's the Elasticsearch mapping for the "operation duration" field? And I assume the Kibana index pattern has it as "Number", correct?

I just tested this in 7.8 using the sample logs data which ship with Kibana, but was unable to reproduce, so I'm trying to figure out what I'm missing

@lukeelmers The Elasticsearch mapping is

    "operationduration": {
              "type": "float"

and yes, Kibana index pattern has it as "Number", searchable and aggregatable.

One recent observation is, if I choose my sum aggregation (summing OperationDuration in this case) metric as "Order By" for my Terms aggregation, then the sum for "other" bucket is calculated properly. But if I choose default count metric (All Events) as "Order By " then I see above issue and sum is always 0. Hope it helps!

@lukeelmers Did you managed to reproduce it?

@webstruck I still haven't had any luck.

I'm using our public demo environment to try to reproduce this, you can see what I have configured here, but so far things are working as expected.

I might have configured the demo visualization incorrectly though -- are you able to reproduce the same issue in the demo environment using one of the sample data sets there? Trying to narrow down whether this is a bug, or perhaps something specific to your environment.

This surely seem to work in your demo environment. What else I could check in my environment?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.