Count distinct values lower than doc_count

Elastic Stack Elasticsearch
1

Hi
i am using cardinality Aggregation Query but some time unique count value less than the previous value..

"size": 0,
"aggs": {
"camgroup": {
"filter": {
"term": {
"RTT": "184"
}
},
"aggs": {
"campevents": {
"terms": {
"field": "REE",
"size": 100000
},
"aggs": {
"zingids": {
"cardinality": {
"field": "ZID"
}
}
}
}
}
}
}
output =>
{
"key" : "9",
"doc_count" : 20224,
"zingids" : {
"value" : 20099
}
},
{
"key" : "5",
"doc_count" : 12439,
"zingids" : {
"value" : 12299
}
},

My question is why doc_count is difference than value, and some time value(12299) becomes less than previous value..

2

In order to scale, certain types of aggregations are approximate, and this includes the cardinality aggregation. You can tune the accuracy, but not get it absolutely accurate if your cardinality is quite high.

3

Please suggest how can i get accurate value..doc_count is also not accurate?

4

Document counts are accurate. The approximation only applies to a subset off aggregation types, and it is generally noted in the docs where values are likely to be approximate.

5

Thank you for reply, i should use doc_count rather than value from out put

{
"key" : "4",
"doc_count" : 49376,
"zingids" : {
"value" : 49066
}
},
{
"key" : "9",
"doc_count" : 21149,
"zingids" : {
"value" : 21462
}
},

is this will be helpful =>
"precision_threshold": 100

6

You can increase precision by increasing the precision_threshold and it takes a value up to 40000.

7

what does it mean? precision_threshold and it takes a value up to 40000.

8

The maximum value that you can set is 40000. This increases precision but uses more system resources.

9

I can also update my query, because i need count so no need to sub aggs :slightly_smiling_face
"size": 0,
"aggs": {
"camgroup": {
"filter": {
"term": {
"RT": "184"
}
},
"aggs": {
"campevents": {
"terms": {
"field": "REE",
"size": 1000000
}
}
}
}
}
this will count accurate value..

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.