# Would Elasticsearch Throttle A Kibana Request to Seven Rows? **URL:** \ **Category:** Elasticsearch\ **Created:** [November 22, 2019, 6:12pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106 "2019-11-22T18:12:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Post date:** [November 22, 2019, 6:12pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106/1 "2019-11-22T18:12:44Z")
Hi Elasticsearch Mages, I have what is probably a difficult forum question… but I’ve gotta ask all the same. I have an ELK pipeline for monitoring network traffic. My Kibana (v 7.4.0) is used to display data from my Elasticsearch (also v 7.4.0). Specifically, I have a Kibana Data Table visualization, that is supposed to display four statistics: - **Metrics:** Sum( AdjBytes ) - **Buckets:** HostA, HostB, App Ex: ``` HostA HostB App AdjBytes 10.10.10.10 20.20.20.20 HTTP 1000 10.10.10.11 20.20.20.20 HTTP 2000 10.10.10.12 20.20.20.21 FTP 5000 ``` And so on. ES and Kibana are working just fine, the data table is displaying accurate information, and everything looks great… …except I’ve noticed that the Kibana data table displays _ **at most seven rows** _ of data. I’m in development, and I can send as much or as little custom traffic as I wish. I’ve noticed the following: - If I send six or less kinds of traffic, I get that exact number of rows in my visualization - If I send seven kinds of traffic, I get exactly seven rows in my visualization - If I send eight or more kinds of traffic, I get exactly _ **seven** _ rows in my visualization (the lowest-numbered “AdjBytes” are dropped.) I first thought this must be a Kibana problem. But when I did an Inspect on Kibana’s request and ES’s response, it looks like Kibana is saying, “_Hey Elasticsearch, send me every value of HostA/HostB/App/AdjBytes you have from Time X to Time Y._” And the ES response only has seven row’s worth of data. The full Kibana request is below, FWIW. I don’t know how to read it, but I don’t see anything that suggests “limit to only 7 rows.” And, like I said, ES sends back data for only seven rows, every time. I’ve hand-verified this on four separate tests. So I’ve got to ask… Does ES have a default setting that throttles its response in a case like this? If so, how could I see (and alter) that? Thank you! FULL DISCLOSURE: I’ve also posted a version of this question in the Kibana forum, [here](https://discuss.elastic.co/t/why-might-a-data-table-visualization-limit-itself-to-only-seven-rows/209107). ``` { "aggs": { "2": { "terms": { "field": "HostA", "order": { "1": "desc" }, "size": 5 }, "aggs": { "1": { "sum": { "field": "AdjBytes" } }, "3": { "terms": { "field": "HostB", "order": { "1": "desc" }, "size": 5 }, "aggs": { "1": { "sum": { "field": "AdjBytes" } }, "4": { "terms": { "field": "Application.keyword", "order": { "1": "desc" }, "size": 5 }, "aggs": { "1": { "sum": { "field": "AdjBytes" } } } } } } } } }, "size": 0, "_source": { "excludes": [] }, "stored_fields": [ "*" ], "script_fields": { "PDH_Sum_Flow": { "script": { "source": "doc['Sample.SamplingRate'].value * doc['Packet.L3.TotalLen'].value", "lang": "painless" } } }, "docvalue_fields": [ { "field": "@timestamp", "format": "date_time" } ], "query": { "bool": { "must": [], "filter": [ { "match_all": {} }, { "match_all": {} }, { "range": { "@timestamp": { "format": "strict_date_optional_time", "gte": "2019-11-21T19:41:30.773Z", "lte": "2019-11-21T19:44:30.773Z" } } } ], "should": [], "must_not": [] } } } ``` ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 22, 2019, 6:31pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106/2 "2019-11-22T18:31:15Z")
Does all your documents that you expect to be part of the table have all fields used in the scripted field defined? Can you show a document that should be in be in the table but is not? What is the cardinality if the hostA field? The first aggregation level is limited to 5 different hostA terms. If the 5 selected all have the same hostB and application you would not see more than 5 rows in the table. ---
**Author:** ![redapplesonly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/redapplesonly/32/57700_2.png) [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Post date:** [November 25, 2019, 1:09pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106/3 "2019-11-25T13:09:40Z")
Hi Christian, Thank you for looking at this for me. I'll keep you questions in my troubleshooting notebook for future reference. The issue, however, boiled down to a Kibana setting. See [here](https://discuss.elastic.co/t/why-might-a-data-table-visualization-limit-itself-to-only-seven-rows/209107/3). But thank you! I think its awesome you thought about this for me! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 23, 2019, 1:09pm UTC](https://discuss.elastic.co/t/would-elasticsearch-throttle-a-kibana-request-to-seven-rows/209106/4 "2019-12-23T13:09:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.