welcome to the Kibana community.
Together with the
doc_count properties, you can see there's also a
doc_count_error_bound property set to -1: when this property is not 0 the system detected an count error of some kind - in this case because it is sorted by a sub-aggregation - and it is reporting that detection result.
terms aggregation works not in an exact way when multiple shards are involved in order to be fast. To have more info about the
size and how errors are reported you can have a look at the official documentation for the
terms aggregation: Terms aggregation | Elasticsearch Guide [7.15] | Elastic
Hi @Marco_Liberati If I increase the size in agg then I'm getting proper result. Is there any way to assign the size dynamically? Please suggest best practice to overcome this issue.
Have you tried adding to your _search, _search?search_type=dfs_quert_then_fetch. I don't know if that will fix the issue, but that way you will distributed search your entire cluster and fetch later. It will be slower, but it might fix it.
Thanks for your response. Still I'm facing same count issue.