I am trying to run some reports to compare rollup vs normal indices, but I am getting different results.
At first I am using the version 6.5 and my config is:
delay: 1d
rollupindex: test-index
index pattern: $productName-$dataset-201806
datehistogram:{field:timestamp, Interval: 24h, timezone: utc}
terms:[response.raw, itemTitle.raw, groupTitle.raw, seriesTitle.raw]
and my rollup query is:
GET test-index/_rollup_search
{
"size": 0,
"aggregations": {
"seriesTitle": {
"terms": {
"field": "seriesTitle.raw",
"size": 3,
"collect_mode": "breadth_first",
"order": {
"_count": "desc"
}
},
"aggregations": {
"groupTitle": {
"terms": {
"field": "groupTitle.raw",
"size": 3,
"order": {
"_count": "desc"
},
"collect_mode": "breadth_first"
},
"aggregations": {
"itemTitle": {
"terms": {
"field": "itemTitle.raw",
"missing": "[No item title]",
"size": 3,
"collect_mode": "breadth_first",
"order": {
"_count": "desc"
}
}
}
}
}
}
}
}
}
If apply the same exact query against the normal index using the _search endpoint, I am getting a different result(the noisy is extremely noticeable)
Regarding the rollup, I thought that we could use any SUBSET of the terms fields set, in any order and at the same time I have seen no restriction until now that we should MANDATORY use it (either in the first level or in any other).
Have I undeRstood something wrong?