Different results between filter and terms within unique count

[haries_fajar_nugroho]

Hello,

I have questions about results differences between filter and terms (i'm using unique count).

By using filter, i get 531 value, the same result compared with the docs that presented (531). But if i use terms, i get 544 value, bigger result compared with the docs that presented (531). If i count the docs, it is 531 documents.

The nearest explanation is in this article: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-order

But that article is explaining about, smaller count if we use terms. What happened to me, i get bigger count by using terms.

Could someone help me regarding this ?

[spinscale (Alexander Reelsen)]

is it possible that some documents contain an array of data on the field you are aggregating on like field: ['foo', 'bar'], so that they fall into two buckets?

Also, can you clarify what you refer to as unique count in this context? Maybe I am misreading this.

--Alex

[haries_fajar_nugroho]

Hi,

It doesn't have any array. The unique count is for a port number of a switch, example: BIN-SW-01 Fa0/1. So, "BIN" refer to location of the switch.