elasticsearch aggregations truncates decimals

Question

This is the query I made using Kibana:

GET sensor-data/_search
{
  "query": { 
    "bool": {
      "must": [
        {
          "term": {
            "devId.keyword": {
              "value": "a8404143e1877ae1"
            }
          }
        },
        {
          "range": {
            "timestamp": {
              "gte": "2023-06-28T11:21:00.447Z",
              "lte": "2023-06-28T11:22:19.447Z"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "max": {
      "max": {
        "field": "data.EnergyMeterV1.u1.v"
      }
    }
  }
}

This is the response I get from elasticsearch:

{
  "took" : 3,
  "timed_out" : false,
  "_shards" : {
    "total" : 3,
    "successful" : 3,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 5.491925,
    "hits" : [
      {
        "_index" : "sensor-data",
        "_type" : "_doc",
        "_id" : "c0C8AYkBNIM9Q_24x62m",
        "_score" : 5.491925,
        "_source" : {
          "$sRef" : "DeviceMetricV1",
          "devId" : "a8404143e1877ae1",
          "timestamp" : "2023-06-28T11:21:31.390Z",
          "data" : {
            "EnergyMeterV1" : {
              "$sRef" : "EnergyMeterV1",
              "u1" : {
                "v" : 234.897,
                "u" : "V"
              }
            }
          }
        }
      }
    ]
  },
  "aggregations" : {
    "max" : {
      "value" : 234.0
    }
  }
}

Notice in hits section that for the query I made, for a very short time interval, there is only one document with value 234.897.

Question: How can I make aggregations to include the value as it is and not truncated from 234.897 to 234.0?

Can you check your index mapping for the field `data.EnergyMeterV1.u1.v`, it might well be that it's been mapped as `integer` or `long` — Val, Jun 29 '23 at 12:50

score 0 · Accepted Answer · answered Jun 29 '23 at 14:01

The result you get is probably due to the fact that your data.EnergyMeterV1.u1.v field is of type integer or long. Even though your source document contains a double, only the integer part has been indexed and the aggregation can only aggregate what's been indexed, i.e. the integer part.

You have two options to fix this:

A. You create a new index with the correct mapping (i.e. double or float type) for the data.EnergyMeterV1.u1.v field and reindex your data from your old index into this new one.

B. You add another double or float field into your current index mapping and then you can update-by-query your index and copy the data.EnergyMeterV1.u1.v field value into the new field you've added.

Depending on the amount of data you have, you might prefer one option over the other, A being the cleanest.

also there is a need for few more steps to have the index with the same name but with the updated mappings. More details here: https://stackoverflow.com/a/59397746/2281611 — Straticiuc Vicu, Jul 03 '23 at 07:37

elasticsearch aggregations truncates decimals

1 Answers1