Incomplete results?


elasticsearch noob here, so forgive me if i get terminology wrong etc.

basically i'm loading a bunch of documents into an elasticsearch index,
currently sitting at 17,000. one of the fields i'm using is called "md5"
and its not_analyzed in the mapping (also tried without to solve this
problem, to no avail)

when looking at the data in kibana, i've added a panel, looking for the
topN md5s and can see they have various values. however when i select one
of those (using the search icon), the number is actually higher than what
was originally displayed in the panel (it was 10, selecting the top md5
actually shows 15..). I've tired copying the exact queries from the
'inspect' options (showing all and the individual md5) and running that
against elasticsearch using curl and the same results show up

I've tried renaming the md5 field to md5_hash and the same problem occurs.
i would appreciate any insight as to what may be happening here as i've
tried everything i can think of ..

  • brian

You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To view this discussion on the web visit
For more options, visit