在使用独特计数并在基巴纳创建聚合时缺少数据 [英] Missing data when using unique count and creating an aggregation in Kibana

问题描述

我在基巴那有一个行为，我不能解释。以下是一个简单的条形图，计数唯一用户，按应用程序和角色过滤，并确保日志中存在某些字段：

此图显示我有约具有Landmand角色的170位用户。如果我将该栏分割为fields.Role这个术语，我会期待一个相同的图表，因为我已经在搜索中应用了一个指定了fields.Role：Landmand的过滤器。但是我看到这个。

这突然将唯一计数限制为约150位用户。我已经尝试过不同的领域，似乎有相同的行为 - 一旦我拆分吧，我似乎以某种方式限制数据。

非常感谢任何信息。

解决方案

使用

如果您转到请求部分，您可以看到阈值已添加到基数聚合中。

I have a behavior in Kibana, I can't explain. The following is a simple bar chart, counting unique users, filtered by application and a role, and ensuring certain fields exist on the logs:

This graph shows that I have approx. 170 users which have the role 'Landmand'. If I split the bar by the term 'fields.Role', I would expect a identical chart, since I already applied a filter specifying 'fields.Role:Landmand' in the search. However I see this.

This suddenly limits the unique count to approx. 150 users. I've tried with different fields and it seems to have the same behavior - as soon as I split the bar, I seem to limit the data somehow.

Any information is greatly appreciated.

解决方案

It happens because it uses the cardinality aggregation to do the unique count. As it is explained in the link, the count is approximate and it has a % of error. Just do a quick test, try to copy the request and try with a different precision threshold to see the difference.

To set a custom precision_threshold you can use the advanced section and put a custom JSON Input to the aggregation:

If you go to the Request section, you can actually see that the threshold has been added to the cardinality aggregation.

这篇关于在使用独特计数并在基巴纳创建聚合时缺少数据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！