# Strange aggregation behavior (returning partial data)

**URL:** <https://discuss.elastic.co/t/strange-aggregation-behavior-returning-partial-data/174495>\
**Category:** Elasticsearch\
**Created:** [March 29, 2019, 8:39am UTC](https://discuss.elastic.co/t/strange-aggregation-behavior-returning-partial-data/174495 "2019-03-29T08:39:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![00a45f9a00ca005db54c](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/00a45f9a00ca005db54c/32/38003_2.png) [@00a45f9a00ca005db54c](https://discuss.elastic.co/u/00a45f9a00ca005db54c)\
**Post date:** [March 29, 2019, 8:39am UTC](https://discuss.elastic.co/t/strange-aggregation-behavior-returning-partial-data/174495/1 "2019-03-29T08:39:15Z")

</div>

Hello there

Elastic aggregation returns sometimes partial data, sometimes full data from the same documents depending on date range.  
Ex. docs:

```
"message": {
      "metadata": {
        "kitId": "07e102c2-c92c-4a9a-9d95-a7f89d006edd",
        "contentId": "1328"
      },
      "type": "APP_METRICS",
      "elasticsearch": {
        "index": "2019.03.28",
        "timestamp": "2019-03-28T14:13:49.177Z"
      },
      "payload": {
        "metric": {
          "name": "What do you expect to see here (test)?",
          "id": "b4ff6780-5163-11e9-9663-5d217198464c",
          "value": 1,
          "subname": "Fitness User"
        }
      }
    }

```

Multiple logs with fields "name", "subname", "value"  
All of them generated with small time difference (ex. all from 28 march 2-3pm)

Aggregations are being made using mseach endpoing. Something like this:

```
"aggs": {
    "metrics": {
      "terms": {
        "field": "message.payload.metric.name.keyword",
        "size": 10000
      },
      "aggs": {
        "submetrics": {
          "terms": {
            "field": "message.payload.metric.subname.keyword"
          }
        },
        "data": {
          "stats": {
            "field": "message.payload.metric.value"
          }
        }
      }
    }
  }

```

And if I take timestamp range for example from 1553731200000 (0.00 28 march) to 1553806740000 - I will get result with sub-aggregation:

```
[
    {
        "name": "What do you expect to see here (test)?",
        "data": {
            "count": 8,
            "min": 1,
            "max": 1,
            "avg": 1,
            "sum": 8
        },
        "submetrics": [
            {
                "name": "Apparel Store!",
                "count": 5
            },
            {
                "name": "Children’s Store",
                "count": 1
            },
            {
                "name": "Cosmetics Store",
                "count": 1
            },
            {
                "name": "Fitness User",
                "count": 1
            }
        ]
    }
]

```

But if I extend "from" time to something less than 1553731200000 (ex. 1553731100000) - I'd expect to see at least same result. But I receive SAME(!) documents without subaggregation:

```
[
    {
        "name": "What do you expect to see here (test)?",
        "data": {
            "count": 8,
            "min": 1,
            "max": 1,
            "avg": 1,
            "sum": 8
        }
    }
]

```

Struggling already for 2 days.  
Any ideas why is this happening? Thanks in advance

---

<div class="post-metadata">

**Author:** ![Ignacio\_Vera](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ignacio_vera/32/36674_2.png) [@Ignacio\_Vera](https://discuss.elastic.co/u/Ignacio_Vera)\
**Post date:** [March 29, 2019, 12:12pm UTC](https://discuss.elastic.co/t/strange-aggregation-behavior-returning-partial-data/174495/2 "2019-03-29T12:12:35Z")

</div>

Could you provide a reproducible example with mappings and data? It is hard to understand what is going on otherwise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 26, 2019, 12:18pm UTC](https://discuss.elastic.co/t/strange-aggregation-behavior-returning-partial-data/174495/3 "2019-04-26T12:18:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.