# Empty Buckets in Terms Aggregation when using .keyword

**URL:** <https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835>\
**Category:** Elasticsearch\
**Created:** [April 27, 2018, 1:03pm UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835 "2018-04-27T13:03:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![YannickWeber](https://avatars.discourse-cdn.com/v4/letter/y/c57346/32.png) [@YannickWeber](https://discuss.elastic.co/u/YannickWeber)\
**Post date:** [April 27, 2018, 1:03pm UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835/1 "2018-04-27T13:03:57Z")

</div>

When performing this Query:

```auto
GET /dnslog/doc/_search
{
  "size" : 0,
  "aggs": {
    "Actions": {
      "terms": {
        "field": "Action.keyword",
        "size": 30
      }
    }
  }
} 
```

I get this result on my local deployment:

```auto
{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 21,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "Actions": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "IN A",
          "doc_count": 7
        },
        {
          "key": "IN SRV",
          "doc_count": 5
        },
        {
          "key": "IN AAAA",
          "doc_count": 4
        },
        {
          "key": "IN SOA",
          "doc_count": 3
        },
        {
          "key": "IN IXFR",
          "doc_count": 1
        },
        {
          "key": "IN TXT",
          "doc_count": 1
        }
      ]
    }
  }
}
```

which is what i want.

but performed on my server i get this:

```auto
{
   "_shards" : {
      "successful" : 5,
      "failed" : 0,
      "total" : 5
   },
   "timed_out" : false,
   "took" : 55,
   "aggregations" : {
      "Actions" : {
         "buckets" : [],
         "sum_other_doc_count" : 0,
         "doc_count_error_upper_bound" : 0
      }
   },
   "hits" : {
      "hits" : [],
      "max_score" : 0,
      "total" : 246648
   }
}
```

removing the .keyword gives me this:

```auto
{
   "aggregations" : {
      "Actions" : {
         "sum_other_doc_count" : 0,
         "doc_count_error_upper_bound" : 0,
         "buckets" : [
            {
               "key" : "in",
               "doc_count" : 170675
            },
            {
               "key" : "a",
               "doc_count" : 122391
            },
            {
               "doc_count" : 39935,
               "key" : "aaaa"
            },
            {
               "key" : "mx",
               "doc_count" : 3598
            },
            {
               "doc_count" : 2055,
               "key" : "txt"
            },
            {
               "doc_count" : 1123,
               "key" : "srv"
            },
            {
               "key" : "soa",
               "doc_count" : 920
            },
            {
               "doc_count" : 533,
               "key" : "ns"
            },
            {
               "key" : "naptr",
               "doc_count" : 81
            },
            {
               "key" : "ixfr",
               "doc_count" : 26
            },
            {
               "key" : "nsec",
               "doc_count" : 6
            },
            {
               "key" : "spf",
               "doc_count" : 5
            },
            {
               "key" : "any",
               "doc_count" : 2
            }
         ]
      }
   },
   "hits" : {
      "hits" : [],
      "max_score" : 0,
      "total" : 170675
   },
   "timed_out" : false,
   "_shards" : {
      "failed" : 0,
      "successful" : 5,
      "total" : 5
   },
   "took" : 209
}
```

Ho do I get my Server deployment to behave like my local deployment?

---

<div class="post-metadata">

**Author:** ![dmitri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dmitri/32/17997_2.png) [@dmitri](https://discuss.elastic.co/u/dmitri)\
**Post date:** [April 27, 2018, 6:09pm UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835/2 "2018-04-27T18:09:59Z")

</div>

Are the mappings of the index the same in both deployments?

---

<div class="post-metadata">

**Author:** ![YannickWeber](https://avatars.discourse-cdn.com/v4/letter/y/c57346/32.png) [@YannickWeber](https://discuss.elastic.co/u/YannickWeber)\
**Post date:** [April 28, 2018, 7:38am UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835/3 "2018-04-28T07:38:49Z")

</div>

I think so, i didnt change any Mappings. The data was put in with the exact same Logstash configuration.

---

<div class="post-metadata">

**Author:** ![YannickWeber](https://avatars.discourse-cdn.com/v4/letter/y/c57346/32.png) [@YannickWeber](https://discuss.elastic.co/u/YannickWeber)\
**Post date:** [April 28, 2018, 9:32am UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835/4 "2018-04-28T09:32:38Z")

</div>

I think I found the reason why i doesnt work: on the server deployment a 2.x version is running, while on my local deployment it is a 6.x version

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 26, 2018, 9:32am UTC](https://discuss.elastic.co/t/empty-buckets-in-terms-aggregation-when-using-keyword/129835/5 "2018-05-26T09:32:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.