Kibana: Allow no restriction on the size of terms aggregations

Created on 29 Dec 2016  路  3Comments  路  Source: elastic/kibana

As per this discuss ticket, it used to be possible to return all results from a sub aggregation by giving 0 as the size option. It looks like this functionality (whether intentional or not) doesn't work in 5.0 because it would pass in 0 as the size, rather than leaving it off. (See #8339).

It would probably be nice to let the user clear that field so no size is sent to elasticsearch and all results would be returned.

screen shot 2016-12-29 at 12 52 30 pm

Visualizations KibanaApp discuss enhancement

Most helpful comment

In case of a table visualisation it actually is kind of a big issue for me, because of the following reason:
I have a couple of hundred thousand documents all containing the same fields. One of my dashboards contains 2 tables, each containing a different set of columns. The problem is they both return a different total amount, if the size of terms is too low (let's say 500). The total amount becomes equal when I change the size of terms to about 50.000, which might become an issue when we reach a couple of million documents I suppose... I guess this issue lies in the fact how many documents have equal values for specific keys which are used for the tables, which might cause a different total amount for the two tables.

So aggregations of unlimited size would still be great to have, because at this right moment I cannot trust the results. Or there has to be another solution for this.

All 3 comments

My understanding was that disallowing terms aggregations of unlimited size was a very intentional change on the Elasticsearch side in 5.0, in order to limit aggregations that could destabilize the cluster: https://github.com/elastic/elasticsearch/issues/18838

Also, I don't see how we can add that support back without it being supported on the API side?

In case of a table visualisation it actually is kind of a big issue for me, because of the following reason:
I have a couple of hundred thousand documents all containing the same fields. One of my dashboards contains 2 tables, each containing a different set of columns. The problem is they both return a different total amount, if the size of terms is too low (let's say 500). The total amount becomes equal when I change the size of terms to about 50.000, which might become an issue when we reach a couple of million documents I suppose... I guess this issue lies in the fact how many documents have equal values for specific keys which are used for the tables, which might cause a different total amount for the two tables.

So aggregations of unlimited size would still be great to have, because at this right moment I cannot trust the results. Or there has to be another solution for this.

Closing this, since this behavior was removed in Elasticsearch (a long time ago).

Was this page helpful?
0 / 5 - 0 ratings