I have a query to return all distinct parent ids that have children with open_flag=1 excluding parent ids that have children with open_flag=0 (open_flag is either 1 or 0 for all chidren). It returns much more results than expected. The list of aggregated contact_ids does include ids where open_flag=0.
The query is performed on alias that have 3 indexes. Elasticsearch version is 1.4.5
{
"query": {
"filtered": {
"filter": {
"bool": {
"must": [
{
"has_child": {
"type": "event",
"filter": {
"bool": {
"must": [
{
"term": {
"open_flag": 1
}
},
]
}
}
}
}
],
"must_not": [
{
"has_child": {
"type": "event",
"filter": {
"bool": {
"must": [
{
"term": {
"open_flag": 0
}
}
],
"must_not": []
}
}
}
}
]
}
}
}
},
"fields": [],
"size": 0,
"aggs": {
"contact_ids": {
"terms": {
"field": "contact_id",
"size": 1000
}
},
"total_count": {
"cardinality": {
"field": "contact_id",
"precision_threshold": 40000
}
}
}
}