Elasticsearch aggregation with regexp

I have the following query:

curl http://localhost:9200/<my_index>/_search

with this body:

"aggs" : {
"host" : {
"terms": {
"field": "host",
"include" : ".*"

Mapping for the 'host' field is like this:

      "host" : {
        "index" : "not_analyzed",
        "type" : "string"

The problem is, when issuing the query, I always get something that starts like this:

"aggregations": {
"host": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 368

My question is: why there are some unmatched documents? As I've shown above, the regexp was: "include" : ".*", meaning all. Am I missing anything?

Thank you!


Don't supply an include clause - that would implicitly mean "all" and using a regex will only add performance overhead.

Ok, thanks for the hint :)!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.