# ES Aggregation (Bug?) - No buckets results at high "min\_doc\_count" and low "size" **URL:** \ **Category:** Elasticsearch\ **Created:** [August 22, 2017, 10:39am UTC](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891 "2017-08-22T10:39:51Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Sinmson](https://avatars.discourse-cdn.com/v4/letter/s/8e8cbc/32.png) [@Sinmson](https://discuss.elastic.co/u/Sinmson)\ **Post date:** [August 22, 2017, 10:39am UTC](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891/1 "2017-08-22T10:39:51Z")
Hey, I have 2 different types of documents. - Request - Response They share the same sessionid. As result I want the aggregated documened grouped by there sessionid. Thats what I did: 1. aggregations by terms sorting by the lowest timestamp 2. top\_hits to include the \_source + sorting the docs, newest first 3. min and max of @timestamp to sort the buckets later on For this I wrote this aggregation: [Aggretation Query 1](https://gist.github.com/Sinmson/a2568b8f8b4cf2878a4f6a29dbf2bc28) [Aggregation Query 2 - Result](https://gist.github.com/Sinmson/2d1788e25cc14bb0d146e29cdb9b2add) As long as "min\_doc\_count" = 2 it works good. It shows the aggregated request and response and their source and this all sorted. But the result also contains **aggregated buckets with a doc\_count of 3**. Those ones **are failures** , where the response server send a 2. response...why ever. To analyse this failure I want to show all buckets with minimum 3 docs in it -\> **i raised "min\_doc\_count" to 3.** [Aggretaion Query 2](https://gist.github.com/Sinmson/10674a075148f9f23e6016ce67d6b7f0) Well (or not well..), no there is no result, see for yourself: [Aggregation Query 2 - Result](https://gist.github.com/Sinmson/6f11f78b0c049144547685a0dfbaee30) And now it gets funny. I know that there have to be results 296 from this 296 elasticsearch should return 10 (because of size in terms). I found multiple strange "solutions" but I do not know why they work. 1. I **change** the **_order_** property in the _terms_ from **_ealiest\_hit_ to "\__terms_"** =\> returns **3 buckets** 2. I **change** the **_order_** property in the _terms_ **from "_ealiest\_hit_" to "\__count_"** =\> **returns as many buckets as I specified in "_size_" in "_terms_"** 3. I **change** the **_field_** property in _min_ / _max_ **from _@timestamp_ to _doc\_count_** =\> returns **4 buckets** 4. I **increase _size_** in _terms_ =\> from 10 **to 100** returns **2 buckets** =\> from 10 **to 1000** returns **81 buckets** I hope anyone can help me. Maybe my hole search query is wrong or you got a better idear, let me know. Is this a bug, should I open a issue at github? Not related with the problem, but I also want to count the aggregated buckets. So that if I search for min\_doc\_count = 3, I want the first 10 aggregated buckets, but I also want the number of maximum buckets (in my case 296). Is this possible / how? I hope this makes sense, if not please ask me what u did not get. It is very easy for me to change some values and test it, so if u got **any** idear, let me know 🙂 Thanks ps first I had a character limi (23000 chars are a bit to much), haha ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [August 22, 2017, 11:15am UTC](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891/2 "2017-08-22T11:15:19Z")
The more of the statements which are true below, the harder the problem you face: - SessionID is a high cardinality field - You are using time-based indices - You have multiple shards - You are not routing documents using session ID. If these are true it's not a great architecture/data model for attempting behavioural analytics. You may want to check out [entity-centric indexing](https://www.youtube.com/watch?v=yBf7oeJKH2Y) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 19, 2017, 11:15am UTC](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891/3 "2017-09-19T11:15:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.