# Elasticsearch @timestamp affects the background document count(bg\_count) of significant\_terms aggregation

**URL:** <https://discuss.elastic.co/t/elasticsearch-timestamp-affects-the-background-document-count-bg-count-of-significant-terms-aggregation/21515>\
**Category:** Elasticsearch\
**Created:** [January 7, 2015, 3:10am UTC](https://discuss.elastic.co/t/elasticsearch-timestamp-affects-the-background-document-count-bg-count-of-significant-terms-aggregation/21515 "2015-01-07T03:10:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hosang\_Jeon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hosang_jeon/32/1020_2.png) [@Hosang\_Jeon](https://discuss.elastic.co/u/Hosang_Jeon)\
**Post date:** [January 7, 2015, 3:10am UTC](https://discuss.elastic.co/t/elasticsearch-timestamp-affects-the-background-document-count-bg-count-of-significant-terms-aggregation/21515/1 "2015-01-07T03:10:26Z")

</div>

Hi all.

I'm using Elasticsearch version 1.4.2 to get _significant terms_ from the  
data gettered by _Logstash_.  
When I do the job using the request below, it works fine.

_# Request (works fine)_

curl -XGET [http://localhost:9200/logstash-2014.11.11,logstash-2014.11.12,logstash-2014.11.13,logstash-2014.11.14,logstash-2014.11.15,logstash-2014.11.16,logstash-2014.11.17,logstash-2014.11.18,logstash-2014.11.19,logstash-2014.11.20,logstash-2014.11.21,logstash-2014.11.22,logstash-2014.11.23,logstash-2014.11.24,logstash-2014.11.25,logstash-2014.11.26,logstash-2014.11.27,logstash-2014.11.28,logstash-2014.11.29,logstash-2014.11.30,logstash-2014.12.01,logstash-2014.12.02,logstash-2014.12.03,logstash-2014.12.04,logstash-2014.12.05,logstash-2014.12.06,logstash-2014.12.07,logstash-2014.12.08,logstash-2014.12.09,logstash-2014.12.10,logstash-2014.12.11/my\_type/\_search?pretty](http://localhost:9200/logstash-2014.11.11,logstash-2014.11.12,logstash-2014.11.13,logstash-2014.11.14,logstash-2014.11.15,logstash-2014.11.16,logstash-2014.11.17,logstash-2014.11.18,logstash-2014.11.19,logstash-2014.11.20,logstash-2014.11.21,logstash-2014.11.22,logstash-2014.11.23,logstash-2014.11.24,logstash-2014.11.25,logstash-2014.11.26,logstash-2014.11.27,logstash-2014.11.28,logstash-2014.11.29,logstash-2014.11.30,logstash-2014.12.01,logstash-2014.12.02,logstash-2014.12.03,logstash-2014.12.04,logstash-2014.12.05,logstash-2014.12.06,logstash-2014.12.07,logstash-2014.12.08,logstash-2014.12.09,logstash-2014.12.10,logstash-2014.12.11/my_type/_search?pretty)  
-d '{  
"query": {  
"filtered": {  
"filter": {  
"and": [  
{  
"term": {  
"myfield.raw":"Something"  
}  
}  
]  
}  
}  
},  
"aggregations": {  
"agg\_by\_remote\_ip": {  
"significant\_terms": {  
"field": "remote\_ip"  
}  
}  
}  
}'

_# Results (bg\_count == 45203)_

```
...
"aggregations" : {
    "agg_by_remote_ip" : {
      "doc_count" : 102,
      "buckets" : [ {
        "key" : "xx.65.xx.112",
        "doc_count" : 102,
        "score" : 10834.56312205343,
        "bg_count" : 45203
      } ]
    }
}

```

However, if I add a _range filter which use @timestamp_ like below, then _it  
reduce the bg\_count_ of the aggregation results.

\*# Added range filter \*

```
{
    "range":{
        "@timestamp":{
            "from":"2014-12-10T15:00:00.000+00:00",
            "to":"2014-12-10T18:00:00.000+00:00"
        }
    }
} 

```

_# Results (bg\_count == 1802)_

```
...
"aggregations" : {
    "agg_by_remote_ip" : {
      "doc_count" : 102,
      "buckets" : [ {
        "key" : "xx.65.xx.112",
        "doc_count" : 102,
        "score" : 10834.56312205343,
        "bg_count" : 1802
      } ]
    }
}

```

The reduced bg\_count value is equal to the result when I use only  
"logstash-2014.12.10" index.  
So, It _seems_ that a range filter which uses @timestamp field _ignores all  
indices that is not int the range_.

Is there anyway to use @timestamp while the bg\_count is not changed in the  
significant\_terms aggregation?

Thanks in advance.

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0dd756a9-cd40-45e2-be7b-79db9237ef96%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0dd756a9-cd40-45e2-be7b-79db9237ef96%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-timestamp-affects-the-background-document-count-bg-count-of-significant-terms-aggregation/21515/2 "2017-07-06T00:40:25Z")

</div>