# Aggs command does not return all the index values expected

**URL:** <https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367>\
**Category:** Elasticsearch\
**Created:** [February 7, 2020, 2:50pm UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367 "2020-02-07T14:50:45Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [February 7, 2020, 2:50pm UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/1 "2020-02-07T14:50:45Z")

</div>

Hello i execute the following command in kibana console in order to get the values for the  
windows.service.name.keyword field:

```
GET /metricbeat-sdok-*/_search
{ "size": 0, 
 "aggs": {
  "sasasa": {
    "terms": {
      "field": "windows.service.name.keyword" 
                    }
               }
          }
}

```

the results are the following:

```
 "aggregations" : {
    "sasasa" : {
      "doc_count_error_upper_bound" : 16745,
      "sum_other_doc_count" : 2698205,
      "buckets" : [
        {
          "key" : "ALG",
          "doc_count" : 16745
        },
        {
          "key" : "AeLookupSvc",
          "doc_count" : 16745
        },
        {
          "key" : "AppIDSvc",
          "doc_count" : 16745
        },
        {
          "key" : "AppMgmt",
          "doc_count" : 16745
        },
        {
          "key" : "AppReadiness",
          "doc_count" : 16745
        },
        {
          "key" : "AppXSvc",
          "doc_count" : 16745
        },
        {
          "key" : "Appinfo",
          "doc_count" : 16745
        },
        {
          "key" : "AudioEndpointBuilder",
          "doc_count" : 16745
        },
        {
          "key" : "Audiosrv",
          "doc_count" : 16745
        },
        {
          "key" : "BFE",
          "doc_count" : 16745
        }
      ]
    }

```

Nevertheless i expected much more buckets because in my index that specific field takes more values as the image below show (for example the: browser value):

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c570dd0265533ae8e0d2ad1117b39366e53c3d7.png)

Why i cant get all the values that i have in my index for the specific variable when i execute the aggs command?

Thank you alot in advance

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 7, 2020, 3:19pm UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/2 "2020-02-07T15:19:10Z")

</div>

The terms aggregation only gives you the ten first matches by default. You can control this by defining the `size` parameter: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-size](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-size)

By default the buckets will be sorted alphabetically. You can change this by using the `order` parameter: [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order)

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [February 11, 2020, 2:49pm UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/3 "2020-02-11T14:49:25Z")

</div>

Hello Joe,

Thank you for your answer. But even when i put the size price:12 instead of 10 for example., i still get only 10 results.

```
GET /metricbeat-sdok-*/_search
{ "size": 12,
 "aggs": {
  "sasasa": {
    "terms": {
      "field": "windows.service.name.keyword" 
                    }
               }
          }
}

 "aggregations" : {
    "sasasa" : {
      "doc_count_error_upper_bound" : 39821,
      "sum_other_doc_count" : 6413441,
      "buckets" : [
        {
          "key" : "ALG",
          "doc_count" : 39821
        },
        {
          "key" : "AeLookupSvc",
          "doc_count" : 39821
        },
        {
          "key" : "AppIDSvc",
          "doc_count" : 39821
        },
        {
          "key" : "AppMgmt",
          "doc_count" : 39821
        },
        {
          "key" : "AppReadiness",
          "doc_count" : 39821
        },
        {
          "key" : "AppXSvc",
          "doc_count" : 39821
        },
        {
          "key" : "Appinfo",
          "doc_count" : 39821
        },
        {
          "key" : "AudioEndpointBuilder",
          "doc_count" : 39821
        },
        {
          "key" : "Audiosrv",
          "doc_count" : 39821
        },
        {
          "key" : "BFE",
          "doc_count" : 39821
        }
      ]
    }
  }
```

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 11, 2020, 3:35pm UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/4 "2020-02-11T15:35:00Z")

</div>

The "size" parameter should be next to the "field" parameter within the definition of the terms agg:

```auto
GET /metricbeat-sdok-*/_search
{ 
 "aggs": {
  "sasasa": {
    "terms": {
      "field": "windows.service.name.keyword",
      "size": 12
                    }
               }
          }
}

```

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [February 12, 2020, 8:43am UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/5 "2020-02-12T08:43:46Z")

</div>

Hello Joe,  
Thank you it worked as you said and i got results .  
The thing that i cant understand is why when i am creating an alert that includes that exact aggs section

```
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "metricbeat-sdok-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "terms": {
                    "host.hostname.keyword": [
                      "sag-dfo-009"
                    ]
                  }
                },
                {
                  "terms": {
                    "windows.service.name.keyword": [
                      "AlwaysUpService.exe"
                    ]
                  }
                },
                {
                  "terms": {
                    "windows.service.name.keyword": [
                      "system.process"
                    ]
                  }
                }
              ],
              "must_not": {
                "term": {
                  "system.process.state.keyword": "runsasaning"
                }
              },
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-120m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "aggs": {
  "sasasa": {
    "terms": {
      "field": "windows.service.name.keyword",
      "size": 12
                    }
               }
          },
  
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "<alexandros.ananikidis@sag-ag.ch>"
        ],
        "subject": "The AlwaysUpService.exe (which monitors the four instances: CATRIN Instanz 1, CATRIN Instanz 2, CATRIN Instanz 3, CATRIN Instanz 4) is not running",
        "body": {
          "text": "Watcher has detected {{ctx.payload.hits.total}} times that the AlwaysUpService.exe is not running in SAG-DFO-007(IP :10.1.161.225) the last 1 minute."
        }
      }
    }
  }
}

```

I get the message shown below:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9cf1d3c4c6c3ea2fd5fd3a9d75b9fc78de205e9.png)

I know that we cannot make aggs on string fields, but i dont use a string field, i use the .keyword part of that string field as the image shows below in the relative index pattern that is aggregatable as the image shows .

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6ed4eede2669af313a9a1ba41caa394557a7a4b2.png)

Thank you very much for your time

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 12, 2020, 8:52am UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/6 "2020-02-12T08:52:41Z")

</div>

Please open a separate issue if you have separate question. That being said, it would be much easier to help you if you would describe what you are trying to achieve up front instead of only disclosing the next part of the problem after you got one step further.

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [February 12, 2020, 8:55am UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/7 "2020-02-12T08:55:00Z")

</div>

Hello Joe i will do exactly as you said.

thank you once again 🙂

Best regards,  
Alexandros

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 8:55am UTC](https://discuss.elastic.co/t/aggs-command-does-not-return-all-the-index-values-expected/218367/8 "2020-03-11T08:55:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.