Kibana - Incorrect Count # with Bucket Aggregation "Terms"

Hello,

This sounds related to the terms returned per shard. Might be worth reading through this discuss issue which includes some helpful links on how to account for and resolve issues related to smaller queries and their interplay with shard size:

Regards,
Aaron