Elasticsearch aggregation with regexp

[ciprian1 (Ciprian Pascu)]

Hi,
I have the following query:

curl http://localhost:9200/<my_index>/_search

with this body:

{
"aggs" : {
"host" : {
"terms": {
"field": "host",
"include" : ".*"
}
}
}
}

Mapping for the 'host' field is like this:

      "host" : {
        "index" : "not_analyzed",
        "type" : "string"
      }

The problem is, when issuing the query, I always get something that starts like this:

"aggregations": {
"host": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 368

My question is: why there are some unmatched documents? As I've shown above, the regexp was: "include" : ".*", meaning all. Am I missing anything?

Thank you!

Ciprian.

[Mark_Harwood]

@ciprian1

As I've shown above, the regexp was: "include" : ".*", meaning all.

Don't supply an include clause - that would implicitly mean "all" and using a regex will only add performance overhead.

[ciprian1 (Ciprian Pascu)]

Ok, thanks for the hint :)!