Aggregation on long type is wrong

Elastic Stack Elasticsearch
1

Can any one explain me what is going on?
I would like to aggregate and get the max value of duration by global_fdid.
I'm expecting to get max duration will be 6860 but it returns 7214.0

GET //_mapping

Result
{
"datav1": {
"mappings": {
"properties": {
"duration": {
"type": "long"
},
"global_fdid": {
"type": "keyword"
},
"update_time": {
"type": "date",
"format": "epoch_millis"
}
}
}
}
}

all result is

GET /<index>/_search
{
	"query":{
		"match_all":{}
	}
}
..
"hits": [
      {
        "_index": "datav1",
        "_type": "_doc",
        "_id": "49600573232619262391802846088499031011924351100857090050.0",
        "_score": 1.0,
        "_source": {
          "duration": 0,
          "global_fdid": "8ed36153-e030-4281-908f-ade92a05d608",
          "update_time": 1573673330132,
        }
      },
      {
        "_index": "datav1",
        "_type": "_doc",
        "_id": "49600573232619262391802846090423640916750840953147752450.0",
        "_score": 1.0,
        "_source": {
          "global_fdid": "8ed36153-e030-4281-908f-ade92a05d608",
          "update_time": 1573673332448,
          "duration": 2316
        }
      },
      {
        "_index": "datav1",
        "_type": "_doc",
        "_id": "49600573232619262391802846092332534785922340488728281090.0",
        "_score": 1.0,
        "_source": {
          "global_fdid": "8ed36153-e030-4281-908f-ade92a05d608",
          "update_time": 1573673334305,
          "duration": 4173
        }
      },
      {
        "_index": "datav1",
        "_type": "_doc",
        "_id": "49600573232619262391802846092973265470318093951322554370.0",
        "_score": 1.0,
        "_source": {
          "global_fdid": "8ed36153-e030-4281-908f-ade92a05d608",
          "update_time": 1573673334821,
          "duration": 4689
        }
      },
      {
        "_index": "datav1",
        "_type": "_doc",
        "_id": "49600573232619262391802846094922053891536876318387863554.0",
        "_score": 1.0,
        "_source": {
          "global_fdid": "8ed36153-e030-4281-908f-ade92a05d608",
          "update_time": 1573673336992,
          "duration": 6860
        }
      }
    ]

So aggregating on global_fdid with max duration will be 6860 but it returns 7214.0

GET /<index>/_search
 {
   "query": {
      "from": 0,
      "size": 0,
      "query": {
        "match_all": {
          
        }
      },
      "aggs": {
        "group_by_0": {
          "terms": {
            "field": "global_fdid",
            "size": 50
          },
          "aggs" : {
            "max_duration" : { 
                "max" : { 
                  "field" : "duration" 
                } 
            }
          }
        }
      }
    }
 }


 >> Result
   "aggregations": {
    "group_by_0": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "8ed36153-e030-4281-908f-ade92a05d608",
          "doc_count": 19,
          "max_duration": {
            "value": 7214.0
          }
        }
      ]
    }
  }
2

The hits you see in your first response are just the first ten results of an arbitrary sort order so the hit with duration 7214 is not visible. Aggregations look at all the matches, not just the first ten.

3

Thank you! Is there any property to show all the data?
I thought

GET /<index>/_search
{
	"query":{
		"match_all":{}
	}
}

will do the job. But I don't see the data that has 7214.0

4

Raw results could be petabytes of data so we don't return stuff like that in a single JSON response.
If you want to scroll your way through all matches take a look at the scroll api

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.