I am using elasticsearch 5.1.1 and kibana also 5.1.1 . I want to check distinct counts for a long value field in elasticsearch i have used cardinality to do this. i have designed three graphs
Userid is my long value field Ex : 54002 ,54004 etc...
total unique userid counts (Metric Graph)
Total unique userid among each hour
Total unique userid among each server.
So here when i cross check total of graph 3 with total of graph 1 both are different . can you please tell me why it is happening. is this because of approximate values for cardinality aggregations or some other issue in designing dashboards.
Yea, this is expected. It's because the chart is counting unique ips per hour (same ip may appear in different hourly buckets) while the metric is counting unique ips across all time. If you change your time range in the graph to a very large value, they should come out the same value:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.