Buckets empty in aggregates

Elastic Stack Elasticsearch
1

I'm using Elasticsearch 1.7.3. I have a very simple query, it's deployed as a template.

{
  "_source": false,
  "query": {
    "filtered": {
      "query": {
        "match_all": {}
      },
      "filter": {
        "range": {
          "record.openedDate": {
            "from": "{{from}}"
          }
        }
      }
    }
  },
  "aggs": {
    "openedMonth": {
      "date_histogram": {
        "field": "record.openedDate",
        "interval": "month"
      },
      "aggs": {
        "byType": {
          "terms": {
            "field": "_type"
          }
        }
      }
    }
  }
}

Usually the report returns buckets, every now and then the buckets come back as empty

{
  "openedMonth": {
    "buckets": [
      {
        "key": 1446336000000,
        "doc_count": 3,
        "byType": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": []
        }
      },
      {
        "key": 1448928000000,
        "doc_count": 2,
        "byType": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": []
        }
      }
    ]
  }
}

Any idea why the buckets are not coming back?

2

That does look a little strange given the date histogram shows 3 and 2 documents for the bucket. Could you add a top_hits aggregation alongside your by_type agg to see what the documents in each bucket look like?

Also, given the same value for from does the issue reproduce every time?

3

I added top hits, didn't impact. It shows the matching hits when its enabled. When buckets is empty, I still can see hits.

The value for from is static, not dynamic, in the test I'm running.

4

I was asking for the top_hits so we could see what they look like to debug what might be going on. Could you share the output from the request with top_hits included?

5

Ah, sorry. Here's the full output.

{
  "openedMonth": {
    "buckets": [
      {
        "key": 1446336000000,
        "doc_count": 3,
        "hits": {
          "hits": {
            "total": 3,
            "max_score": 1,
            "hits": [
              {
                "_index": "t123",
                "_type": "t123type1",
                "_id": "5",
                "_score": 1,
                "_source": {
                  "objectId": "5",
                  "objectIndexId": 123,
                  "record": {
                    "status": "Opened",
                    "typeName": "type1",
                    "openedDate": 1446336000000
                  },
                  "oId": 123,
                  "objectIndexType": "t123type1"
                }
              },
              {
                "_index": "t123",
                "_type": "t123type1",
                "_id": "2",
                "_score": 1,
                "_source": {
                  "objectId": "2",
                  "objectIndexId": 123,
                  "record": {
                    "status": "Opened",
                    "typeName": "type1",
                    "openedDate": 1446336000000
                  },
                  "oId": 123,
                  "objectIndexType": "t123type1"
                }
              },
              {
                "_index": "t123",
                "_type": "t123type2",
                "_id": "4",
                "_score": 1,
                "_source": {
                  "objectId": "4",
                  "objectIndexId": 123,
                  "record": {
                    "status": "Opened",
                    "typeName": "type2",
                    "openedDate": 1446336000000
                  },
                  "oId": 123,
                  "objectIndexType": "t123type2"
                }
              }
            ]
          }
        },
        "byType": {
          "doc_count_error_upper_bound": 0,
          "sum_other_doc_count": 0,
          "buckets": []
        }
      }
    ]
  }
}