Painless scripted value versus field cardinality discrepancy [ES 7.0]

Elastic Stack Elasticsearch
1

Hi!

I have IP addresses mapped as IP and I stumbled upon a weird issue (or I'm missing sth).
If I request an aggregation where I use a painless script, I get more unique values than the "simple" field cardinality. I dumped down the query enough to rule out other factors and still got different results.

"aggs": {
  "1": {
    "terms": {
      "field": "city.keyword",
      "size": 10000
    },
    "aggs": {   
      "card_normal": {
        "cardinality": {
          "field": "applet_ipaddress"
        }
      },
      "card_scripted": {
        "cardinality": {
          "script": {
            "lang": "painless",
            "source":
              " return doc['applet_ipaddress'].value "
          }
        }
      }
    }
  }
}

Result:

    {
      "key" : "London",
      "doc_count" : 31228,
      "card_normal" : {
        "value" : 4273
      },
      "card_scripted" : {
        "value" : 4282
      }
    }

Also, when I tried to get all the addresses to compare, I got the same set (I performed two queries), and there was only 4246 unique key ....
Any thoughts on this?

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.