When performing this Query: GET /dnslog/doc/_search { "size" : 0, "aggs": { "Actions": { "terms": { "field": "Action.keyword", "size": 30 } } } } I get this result on my local deployment: { "took": 1, "timed_out": false, "_shards": { "total": 5,…

Are the mappings of the index the same in both deployments?

I think so, i didnt change any Mappings. The data was put in with the exact same Logstash configuration.

Empty Buckets in Terms Aggregation when using .keyword

YannickWeber (YannickWeber) April 28, 2018, 9:32am 4

I think I found the reason why i doesnt work: on the server deployment a 2.x version is running, while on my local deployment it is a 6.x version

Topic		Replies	Views
Unable to retreive aggregation for keyword field with high cardinality (Data Table) Elasticsearch	3	477	March 24, 2020
Terms aggregation on a keyword field returns no results Elasticsearch	2	469	November 24, 2020
Keyword field on bucket aggregation Elasticsearch	2	1038	November 30, 2017
"aggregations" do not work any more (index corrupt ?) - resolved Elasticsearch	10	1866	July 5, 2017
Wrong results on Terms Aggregations Elasticsearch	3	423	July 6, 2017