Different aggregation result when filtering just one term

Elastic Stack Elasticsearch
1

Hello,
I have an aggregation query and it sums just one doc for a particular term but if I query one term it sums over 2 docs. I do not understand why I get a different result with and without query which should not make a difference.

Let say the query is

{
  "size": 0,
  
  "aggs": {
    "2": {
      "terms": {
        "field": "round_id",
        "size": 1,
     
        "order": {
          "sum1": "desc"
        }
      },
      "aggs": {
        "sum1": {
          "sum": {
            "field": "real_win"
            
          }
        },
        "sum2": {
          "sum": {
            "field": "real_bet"
 
          }
        }
      }
    }
  },
  
  "query": {
    "bool": {
      "must": [
        {
          "match_all": {}
        },
        {
          "range": {
            "created_at": {
              "gte": "2018-05-17T05:20:20",
              "lte": "2018-05-17T05:30:20"
                        }
          }
        }
      ]
     }
  }
}

The result is:

"buckets": [
        {
          "key": 1176640530,
          "doc_count": 1,
          "sum1": {
            "value": 5488
          },
          "sum2": {
            "value": 0
          }
        }
      ]

When I change match_all to:

"term": {
            "round_id": {
              "value": "1176640530"
            }
          }

where 1176640530 key is the only result from previos aggregation I get different results.

"buckets": [
        {
          "key": 1176640530,
          "doc_count": 2,
          "sum1": {
            "value": 5488
          },
          "sum2": {
            "value": 9
          }
        }
      ]

Thanks, can anybody give me a hint what can cause the difference, please?

2

See notes on accuracy and how to improve it.

3

I was reading that part but I actually do not care about document count but about the second aggregation sum2. It returns 0 but one of those 2 docs has it bigger than 0. Is also sum aggregation inaccurate? I think it should not be, right?

4

The doc count is the size of the document set considered.
The sum aggregation (and all other metric aggs) only operate on the docs in this set. If you're not considering all the docs your metrics will also be off.

5

Thank you for your explanation.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.