# TOP 10 Average data sheet

**URL:** <https://discuss.elastic.co/t/top-10-average-data-sheet/168893>\
**Category:** Kibana\
**Created:** [February 18, 2019, 7:50pm UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893 "2019-02-18T19:50:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [February 18, 2019, 7:50pm UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/1 "2019-02-18T19:50:13Z")

</div>

Hi!

I need to get a list of the processes which are running the longest on average. But when I set the Metrics to "average" of the "process\_time" field and split the rows by the term "process\_name" I get confusing results where I know not all documents have been taken into account. If I change the size of the number of terms, the average metric changes too, not only the number of the terms returned.  
How can I get all terms' average process time calculated and then listing the TOP 10 of those?

Thanks!

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 22, 2019, 9:54am UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/2 "2019-02-22T09:54:49Z")

</div>

Hi [YvorL](https://discuss.elastic.co/u/YvorL),

that's really strange, I just tried the some thing (well instead of process\_time I average on bytes and instead of process\_name I split the rows on OS, but that shouldn't change a thing) and it works for me. This is my configuration

 ![47](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d236434c6af40bdadab308e91a173d7a14b92812.png)

Which version of Kibana are you using?

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [February 22, 2019, 10:43am UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/3 "2019-02-22T10:43:35Z")

</div>

Version 6.6.0

I can reproduce it with other metrics like in the case below. I have the max value there so you see (or at least believe more) that the terms are the same without sharing those.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b7468961a85b72ca12fc11f3381a9a7883bcbbb.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 22, 2019, 1:25pm UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/4 "2019-02-22T13:25:30Z")

</div>

Would you mind sharing your request JSON? (Inspect in the top nav, View: Requests in the top right corner and there the content of the Request tab)  
If something is going wrong it should show in the actual request sent to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [February 26, 2019, 8:04pm UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/5 "2019-02-26T20:04:18Z")

</div>

Sorry @flash1293, I didn't see the notice about your message.  
It turned out that this behavior is expected since [terms aggregation count is approximate](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-approximate-counts).

Thank you for your time!

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 28, 2019, 9:31am UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/6 "2019-02-28T09:31:53Z")

</div>

Hi @YvorL,

great to hear you solved your problem.

The difference in counts shouldn't be that big due to that - you may have too many shards for your index (the default is 5). Ideally the size of a shard should be 10-40GB - if you have less data, just use a single shard and this problem shouldn't happen.

---

<div class="post-metadata">

**Author:** ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)\
**Post date:** [February 28, 2019, 10:47am UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/7 "2019-02-28T10:47:27Z")

</div>

> you may have too many shards for your index (the default is 5). Ideally the size of a shard should be 10-40GB

That's right, the shard count change is on the roadmap, but first I need to change other things in the index in question.

Thanks again!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2019, 10:47am UTC](https://discuss.elastic.co/t/top-10-average-data-sheet/168893/8 "2019-03-28T10:47:30Z")

</div>

Closed on March 28, 2019, 10:47am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
