# Painless scripted value versus field cardinality discrepancy \[ES 7.0\]

**URL:** https://discuss.elastic.co/t/painless-scripted-value-versus-field-cardinality-discrepancy-es-7-0/180855
**Category:** Elasticsearch
**Created:** [May 13, 2019, 5:43pm UTC](https://discuss.elastic.co/t/painless-scripted-value-versus-field-cardinality-discrepancy-es-7-0/180855 "2019-05-13T17:43:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![YvorL](https://avatars.discourse-cdn.com/v4/letter/y/9fc348/32.png) [@YvorL](https://discuss.elastic.co/u/YvorL)
#### Post date: [May 13, 2019, 5:43pm UTC](https://discuss.elastic.co/t/painless-scripted-value-versus-field-cardinality-discrepancy-es-7-0/180855/1 "2019-05-13T17:43:14Z")

</div>

Hi!

I have IP addresses mapped as IP and I stumbled upon a weird issue (or I'm missing sth).  
If I request an aggregation where I use a painless script, I get more unique values than the "simple" field cardinality. I dumped down the query enough to rule out other factors and still got different results.

```
"aggs": {
  "1": {
    "terms": {
      "field": "city.keyword",
      "size": 10000
    },
    "aggs": {   
      "card_normal": {
        "cardinality": {
          "field": "applet_ipaddress"
        }
      },
      "card_scripted": {
        "cardinality": {
          "script": {
            "lang": "painless",
            "source":
              " return doc['applet_ipaddress'].value "
          }
        }
      }
    }
  }
}

```

Result:

```
    {
      "key" : "London",
      "doc_count" : 31228,
      "card_normal" : {
        "value" : 4273
      },
      "card_scripted" : {
        "value" : 4282
      }
    }

```

Also, when I tried to get all the addresses to compare, I got the same set (I performed two queries), and there was only 4246 unique key ....  
Any thoughts on this?

Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 10, 2019, 5:43pm UTC](https://discuss.elastic.co/t/painless-scripted-value-versus-field-cardinality-discrepancy-es-7-0/180855/2 "2019-06-10T17:43:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.