Aggregate sum wrong with huge datasets

Hi all and sorry for my poor english.
Hi have data like that:

{
 "_index": "statistic",
 "_type": "_doc",
 "_id": "df5d295f-99bf-49b3-b640-a9000461de3a",
 "_score": 1.0,
 "_source":{
 "_class": "com.x.dsp.elasticssearch.model.StatisticDTO",
 "statisticID": "df5d295f-99bf-49b3-b640-a9000461de3a",
 "accountUuid": "account-1",
 "profileID": "profile-1",
 "currentDate": 1612256400000,
 "appCategory": "app-1",
 "fastwebCategory": "Streaming",
 "serviceName": "Dazn299",
 "usageDownload": 1,
 "usageUpload": 1,
 "totalTraffic": 2,
 "usageTime": 5
}

and i'm doing a query like that

{
  "aggs": {
	"filtered": {
	  "filter": {
		"bool": {
		  "must": [
			{
			  "term":                 {
				"accountUuid": "account-1"
			  }              
			},
			{
			  "term":                 {
				"profileID": "profile-1"
			  }               
			},
			{
			  "range": {
				"currentDate": {
				  "from": 1603901579369,
				  "to": 1706493579369                  
				}                
			  }              
			}            ]          
		}        
	  },
	  "aggs": {
			"usage_time_histogram" : {
			  "date_histogram" : {
				"field" : "currentDate",
				"interval" : "day"                 
			  },
			  "aggs": {
				"category": {
				  "terms": {
					"field": "fastwebCategory" 
				  } ,
				  "aggs": {
					"services": {
					  "terms": {
						 "field": "serviceName" 
					  } ,
					  "aggs":{
							"usageTimePerService": {
							  "sum": {
								 "field": "usageTime" 
							   }  
							 } 
					  }
					  
					}  
				  }  
				} 
			  }
			}   ,
                            "totalTraffic": {
                                   "sum": {
                                   "field": "totalTraffic"                            
                              }                          
                          }   
	  }      
	}     
  },
  "size": 0  
}

But actually it returns wrong totalTraffic sum (consider i have a huge db).Is it related to search.max_bucket parameter set too low?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.