Vertical bar chart issue in kibana

Elastic Stack Kibana
1

HI Team,
I'm facing very new issue while creating bar chart in visualization. I want to create grouped bar. when i passing the input its not creating correctly. This are my inputs,

1st bucket Split bars,
Aggregation type - Filter
Filter 1 Condition - "A"
Filter 2 Condition - "A" or "B"
2nd bucket x-Axis
sub aggregation type- Terms
Field - Name
size - 5

when i apply this it creating grouped bar correctly for first 4 only. 5 bar is not grouped and when i click and apply name filter of 5 bar it shows both filter1 and filter 2 value.. Why its mesh up like this and one more i have given top 5 but its show another one more bar in the graph. Please find the below image,

2

I am going to guess that the keys of the buckets in your "A" results don't exactly line up to the keys of the buckets in your "A" or "B" results. When you gave size: 5 in your sub-aggregation, that makes it so the "A" filter is limited to 5, and your "A" or "B" results are limited to 5. It looks like out of that, 4 keys do correspond across both filters, but 1 key only exists in your "A" filter, and another key only exists in your "A" or "B" filter.

I can pretty much reproduce this with some test Apache log data, in the master branch of Kibana:

Screen Shot 2016-08-10 at 4.57.54 PM.png3164×1858 370 KB

Now if I look in the "spy" panel and copy the aggregation DSL, and put it into Console (previously known as Sense), I get this:

Screen Shot 2016-08-10 at 4.59.36 PM.png3472×2278 772 KB

Here's my actual response data:

"aggregations": {
    "2": {
      "buckets": {
        "\"A\"": {
          "3": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 1092,
            "buckets": [
              {
                "key": "\"Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)\"",
                "doc_count": 736
              },
              {
                "key": "\"Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)\"",
                "doc_count": 609
              },
              {
                "key": "\"Mozilla/5.0 (compatible; MJ12bot/v1.4.4; http://www.majestic12.co.uk/bot.php?+)\"",
                "doc_count": 593
              },
              {
                "key": "\"Mozilla/5.0 (compatible; AhrefsBot/5.0; +http://ahrefs.com/robot/)\"",
                "doc_count": 550
              },
              {
                "key": "\"Wotbox/2.01 (+http://www.wotbox.com/bot/)\"",
                "doc_count": 278
              }
            ]
          },
          "doc_count": 3858
        },
        "\"A\" or \"B\"": {
          "3": {
            "doc_count_error_upper_bound": 30,
            "sum_other_doc_count": 2242,
            "buckets": [
              {
                "key": "\"Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)\"",
                "doc_count": 738
              },
              {
                "key": "\"Tiny Tiny RSS/1.11 (http://tt-rss.org/)\"",
                "doc_count": 662
              },
              {
                "key": "\"Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)\"",
                "doc_count": 610
              },
              {
                "key": "\"Mozilla/5.0 (compatible; MJ12bot/v1.4.4; http://www.majestic12.co.uk/bot.php?+)\"",
                "doc_count": 594
              },
              {
                "key": "\"Mozilla/5.0 (compatible; AhrefsBot/5.0; +http://ahrefs.com/robot/)\"",
                "doc_count": 553
              }
            ]
          },
          "doc_count": 5399
        }
      }
    }
  }

Now if you look at each inner-level bucket, they are each limited to 5, but which 5 they are isn't a complete overlap. It looks like that is what is happening in your case.

3

How to over come this? Because when i click the single keys bar it applying filter by use name i can find the both Filter 1 and filter 2 but if i remove the filter which i applied it show single key in diagram,