# Inconsistent results (again) **URL:** \ **Category:** Elasticsearch\ **Created:** [March 30, 2012, 1:34pm UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179 "2012-03-30T13:34:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![George\_Sakkis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_sakkis/32/2801_2.png) [@George\_Sakkis](https://discuss.elastic.co/u/George_Sakkis)\ **Post date:** [March 30, 2012, 1:34pm UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/1 "2012-03-30T13:34:53Z")
Hi, I'm starting a new thread as I can't can't reply to a previous one [1] about the same (most likely) issue on a 2-node cluster: $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} There is one replica per shard and the num\_docs of each primary matches the respective replica. What could be the problem? Thanks, George [1] [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e1257f52f0e7de1](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e1257f52f0e7de1) ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [March 31, 2012, 8:52pm UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/2 "2012-03-31T20:52:40Z")
Can you do a get mapping on the index, and see if you have app\_id field in several mapping types? On Fri, Mar 30, 2012 at 4:34 PM, George Sakkis [george.sakkis@gmail.com](mailto:george.sakkis@gmail.com)wrote: > Hi, > > I'm starting a new thread as I can't can't reply to a previous one [1] > about the same (most likely) issue on a 2-node cluster: > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > There is one replica per shard and the num\_docs of each primary matches > the respective replica. What could be the problem? > > Thanks, > George > > [1] > [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e1257f52f0e7de1](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e1257f52f0e7de1) ---
**Author:** ![George\_Sakkis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_sakkis/32/2801_2.png) [@George\_Sakkis](https://discuss.elastic.co/u/George_Sakkis)\ **Post date:** [April 2, 2012, 9:20am UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/3 "2012-04-02T09:20:39Z")
Hi Shay, yes multiple types have an app\_id. Digging deeper into it, I found the problem seems to happen for array fields (like app\_id), not scalar ones. Here's another example: # location is scalar $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} # mail is an array $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} Just to clarify, this happens only for the one apparently corrupted index (index\_2012-03-30\_00-10-07). Both previous indices and one I built from scratch after that look stable. Thanks, George On Mar 31, 10:52 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > Can you do a get mapping on the index, and see if you have app\_id field in > several mapping types? > > On Fri, Mar 30, 2012 at 4:34 PM, George Sakkis [george.sak...@gmail.com](mailto:george.sak...@gmail.com)wrote: > > > Hi, > > > I'm starting a new thread as I can't can't reply to a previous one [1] > > about the same (most likely) issue on a 2-node cluster: > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > There is one replica per shard and the num\_docs of each primary matches > > the respective replica. What could be the problem? > > > Thanks, > > George > > > [1] > > [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e125](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e125)... ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [April 3, 2012, 2:14pm UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/4 "2012-04-03T14:14:05Z")
Strange, fields with multiple values does not really affect this. My thought was that app\_id maybe has different core type (string in one mapping type, numeric in another), and in 0.19, the resolution of using the correct mapping when searching explicitly against the mapping type is better. When searching across all types, then you might get strange results in this case. On Mon, Apr 2, 2012 at 12:20 PM, George Sakkis [george.sakkis@gmail.com](mailto:george.sakkis@gmail.com)wrote: > Hi Shay, > > yes multiple types have an app\_id. Digging deeper into it, I found the > problem seems to happen for array fields (like app\_id), not scalar > ones. Here's another example: > > # location is scalar > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > # mail is an array > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sakkis@gmail.com'` > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > > Just to clarify, this happens only for the one apparently corrupted > index (index\_2012-03-30\_00-10-07). Both previous indices and one I > built from scratch after that look stable. > > Thanks, > George > > On Mar 31, 10:52 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > > > Can you do a get mapping on the index, and see if you have app\_id field > > in > > several mapping types? > > > > On Fri, Mar 30, 2012 at 4:34 PM, George Sakkis \<[george.sak...@gmail.com](mailto:george.sak...@gmail.com) > > wrote: > > > > > Hi, > > > > > I'm starting a new thread as I can't can't reply to a previous one [1] > > > about the same (most likely) issue on a 2-node cluster: > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > There is one replica per shard and the num\_docs of each primary matches > > > the respective replica. What could be the problem? > > > > > Thanks, > > > George > > > > > [1] > > > [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e125](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e125). > > > .. ---
**Author:** ![George\_Sakkis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/george_sakkis/32/2801_2.png) [@George\_Sakkis](https://discuss.elastic.co/u/George_Sakkis)\ **Post date:** [April 4, 2012, 8:27am UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/5 "2012-04-04T08:27:44Z")
Ah no, app\_id is integer in all mapping types. This is on 0.18.7. Do you have any input on that comment from the other thread? Without knowing much about the internals it sounds the most relevant so far: "I've seen the mismatched counts issue on a 4-node cluster, although it was only after some reconfiguration work that introduced temporary network partitions. Reindexing resolved the issue, and it hasn't recurred. Recovery from losing a node might eliminate the imbalance." Can I somehow check if there was a temp. network partition during indexing, and if yes is it possible to recover from it (without having to do a full reindeing that is)? On Apr 3, 4:14 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > Strange, fields with multiple values does not really affect this. My > thought was that app\_id maybe has different core type (string in one > mapping type, numeric in another), and in 0.19, the resolution of using the > correct mapping when searching explicitly against the mapping type is > better. When searching across all types, then you might get strange results > in this case. > > On Mon, Apr 2, 2012 at 12:20 PM, George Sakkis [george.sak...@gmail.com](mailto:george.sak...@gmail.com)wrote: > > > Hi Shay, > > > yes multiple types have an app\_id. Digging deeper into it, I found the > > problem seems to happen for array fields (like app\_id), not scalar > > ones. Here's another example: > > > # location is scalar > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > > # mail is an array > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > > > Just to clarify, this happens only for the one apparently corrupted > > index (index\_2012-03-30\_00-10-07). Both previous indices and one I > > built from scratch after that look stable. > > > Thanks, > > George > > > On Mar 31, 10:52 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > > > > > Can you do a get mapping on the index, and see if you have app\_id field > > > in > > > several mapping types? > > > > On Fri, Mar 30, 2012 at 4:34 PM, George Sakkis \<[george.sak...@gmail.com](mailto:george.sak...@gmail.com) > > > wrote: > > > > > Hi, > > > > > I'm starting a new thread as I can't can't reply to a previous one [1] > > > > about the same (most likely) issue on a 2-node cluster: > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > There is one replica per shard and the num\_docs of each primary matches > > > > the respective replica. What could be the problem? > > > > > Thanks, > > > > George > > > > > [1] > > > > [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e125](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e125). > > > > .. ---
**Author:** ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy)\ **Post date:** [April 4, 2012, 1:46pm UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/6 "2012-04-04T13:46:34Z")
If you had a network partition, you would end up with two clusters..., you can check the logs to see if it happened (you will see disconnected nodes messages). Can you try and recreate the problem? On Wed, Apr 4, 2012 at 11:27 AM, George Sakkis [george.sakkis@gmail.com](mailto:george.sakkis@gmail.com)wrote: > Ah no, app\_id is integer in all mapping types. This is on 0.18.7. > > Do you have any input on that comment from the other thread? Without > knowing much about the internals it sounds the most relevant so far: > > "I've seen the mismatched counts issue on a 4-node cluster, although > it > was only after some reconfiguration work that introduced temporary > network partitions. Reindexing resolved the issue, and it hasn't > recurred. Recovery from losing a node might eliminate the imbalance." > > Can I somehow check if there was a temp. network partition during > indexing, and if yes is it possible to recover from it (without having > to do a full reindeing that is)? > > On Apr 3, 4:14 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > > > Strange, fields with multiple values does not really affect this. My > > thought was that app\_id maybe has different core type (string in one > > mapping type, numeric in another), and in 0.19, the resolution of using > > the > > correct mapping when searching explicitly against the mapping type is > > better. When searching across all types, then you might get strange > > results > > in this case. > > > > On Mon, Apr 2, 2012 at 12:20 PM, George Sakkis \<[george.sak...@gmail.com](mailto:george.sak...@gmail.com) > > wrote: > > > > > Hi Shay, > > > > > yes multiple types have an app\_id. Digging deeper into it, I found the > > > problem seems to happen for array fields (like app\_id), not scalar > > > ones. Here's another example: > > > > > # location is scalar > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=location:London'` > > > {"count":575,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > # mail is an array > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > > {"count":20,"\_shards":{"total":5,"successful":5,"failed":0}} > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count? q=mail:george.sak...@gmail.com'` > > > {"count":1,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > Just to clarify, this happens only for the one apparently corrupted > > > index (index\_2012-03-30\_00-10-07). Both previous indices and one I > > > built from scratch after that look stable. > > > > > Thanks, > > > George > > > > > On Mar 31, 10:52 pm, Shay Banon [kim...@gmail.com](mailto:kim...@gmail.com) wrote: > > > > > > > Can you do a get mapping on the index, and see if you have app\_id > > > > field > > > > in > > > > several mapping types? > > > > > > On Fri, Mar 30, 2012 at 4:34 PM, George Sakkis \< > > > > [george.sak...@gmail.com](mailto:george.sak...@gmail.com) > > > > wrote: > > > > > > > Hi, > > > > > > > I'm starting a new thread as I can't can't reply to a previous one > > > > > [1] > > > > > about the same (most likely) issue on a 2-node cluster: > > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > > {"count":13589,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > > > $ echo `curl -s -XGET 'localhost:9200/index_2012-03-30_00-10-07/_count?q=app_id:14956'` > > > > > {"count":0,"\_shards":{"total":5,"successful":5,"failed":0}} > > > > > > > There is one replica per shard and the num\_docs of each primary > > > > > matches > > > > > the respective replica. What could be the problem? > > > > > > > Thanks, > > > > > George > > > > > > > [1] > > [https://groups.google.com/group/elasticsearch/browse\_frm/thread/7e125](https://groups.google.com/group/elasticsearch/browse_frm/thread/7e125). > > > > .. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 3:33am UTC](https://discuss.elastic.co/t/inconsistent-results-again/7179/7 "2017-07-06T03:33:42Z")