# Elasticsearch 5.6 - Query Return Wrong Data

**URL:** <https://discuss.elastic.co/t/elasticsearch-5-6-query-return-wrong-data/134878>\
**Category:** Elasticsearch\
**Created:** [June 7, 2018, 2:54am UTC](https://discuss.elastic.co/t/elasticsearch-5-6-query-return-wrong-data/134878 "2018-06-07T02:54:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alon.eldi](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@alon.eldi](https://discuss.elastic.co/u/alon.eldi)\
**Post date:** [June 7, 2018, 2:54am UTC](https://discuss.elastic.co/t/elasticsearch-5-6-query-return-wrong-data/134878/1 "2018-06-07T02:54:34Z")

</div>

Hi ,  
We have EasticSearch Index which store nested json data .  
Its ES 5.6 we exceeded the default limitaton of number of fields and nested fields so our mapping contain :  
"mapping": {  
"nested\_fields": {  
"limit": "200"  
},  
"total\_fields": {  
"limit": "15000"  
},  
"depth": {  
"limit": "100"  
}  
}  
}

The query that brings wrong data is -

GET ltm/\_search  
{

"query": {

```
"bool": {

  "must": [

    {

      "term": {

        "modbus_rtu.function": 21

      }

    },

    {

      "term": {

        "general_info.protocol" : "modbus_rtu"

      }

    }

  ]

}

```

}

}

The record that we are looking to find is -

PUT ltm/insight/1  
{  
"frame": {  
"protocols": "eth:ethertype:ip:tcp:mbrtu:modbus:modbus:modbus",  
"encap\_type": 1,  
"len": 70  
},  
"eth": {  
"destination\_address": "cc:ef:48:cb:50:00",  
"source\_address": "80:c1:6e:6f:9a:c8",  
"type": "0x00000800",  
"type\_meaning": "Internet Protocol version 4 (IPv4)"  
},  
"ip": {  
"version": 4,  
"hdr\_len": 20,  
"ds\_field": "0x00000000",  
"len": 56,  
"id": "0x000052b7",  
"flags": "0x00000002",  
"frag\_offset": 0,  
"ttl": 64,  
"proto": 6,  
"proto\_meaning": "TCP",  
"checksum": "0x000099de",  
"src": "0xc0a86f57",  
"src\_meaning": "192.168.111.87",  
"dst": "0xc0a85d82",  
"dst\_meaning": "192.168.93.130",  
"version\_meaning": "IPv4"  
},  
"tcp": {  
"srcport": 48891,  
"dstport": 502,  
"seq": 9,  
"ack": 1,  
"hdr\_len": 20,  
"flags": "0x00000019",  
"window\_size": 258,  
"checksum": "0x0000ba29",  
"urgent": 0,  
"flags\_meaning": "Flags: 0x019 (FIN, PSH, ACK)"  
},  
"mbrtu": {  
"direction": "query",  
"unit\_id": 27,  
"crc16": "0x00000143",  
"crc16\_status": 2,  
"dest\_uid": 27  
},  
"modbus\_rtu": {  
"byte\_cnt": 0,  
"function": 21,  
"modbus\_meaning": "Modbus",  
"byte\_cnt\_meaning": "Byte Count: 0",  
"func\_code\_meaning": " Function Code: Get Comm. Event Log (12)"  
},  
"general\_info": {  
"protocol": "modbus\_rtu",  
"direction": "client\_to\_server",  
"malformed": "True",  
"blackbox\_name": "BBX\_10.20.30.60",  
"blackbox\_id": 2,  
"UTC\_timestamp": "2018-06-06T08:36:35.743Z",  
"local\_timestamp": "2018-06-06T11:36:35.743Z",  
"epoch": 1528274195.743346,  
"archive": 0,  
"read": 0,  
"type": "insight"  
}  
}

The query return also wrong records with - "modbus\_rtu.function":12

When we write the Json data to different index there is no problem .  
Re-indexing the whole index to different one we get the same problem

POST \_reindex  
{  
"source": {  
"index": "ltm"  
},  
"dest": {  
"index": "ltm\_new"  
}  
}  
Note - I have set the ltm\_new index mapping to support more then 1500 fields , etc before re-indxing ,  
So it seems that the problem occurrs when the problematic record is stored as part of other long Json Records .

We did not had such problem in ES 2.4 - I'm going to double check it .

Did You face this problem ? What can cause it ? How is it possible to solve it

Thanks

Alon

---

<div class="post-metadata">

**Author:** ![alon.eldi](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@alon.eldi](https://discuss.elastic.co/u/alon.eldi)\
**Post date:** [June 11, 2018, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-query-return-wrong-data/134878/2 "2018-06-11T13:09:56Z")

</div>

This is really strange issue . We have an engine in C++ that write the data using curl into elastic . Most of the fields , we have many \> 1000 are OK . This specific field return wrong result data .  
This issue exists in ES 5 and 2.4 .

I have tested it using Python API - Pull all data into 1 file containing many JSON and then re-index them to different index .Data was OK . No Query wrong results .

This is really mystery .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2018, 1:09pm UTC](https://discuss.elastic.co/t/elasticsearch-5-6-query-return-wrong-data/134878/3 "2018-07-09T13:09:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.