# Terms aggregation shows up irrevelant data

**URL:** <https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287>\
**Category:** Elasticsearch\
**Created:** [December 12, 2017, 9:48am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287 "2017-12-12T09:48:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![fvilpoix](https://avatars.discourse-cdn.com/v4/letter/f/22d042/32.png) [@fvilpoix](https://discuss.elastic.co/u/fvilpoix)\
**Post date:** [December 12, 2017, 9:48am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/1 "2017-12-12T09:48:43Z")

</div>

Hi,

I've a weird behaviour, using terms aggregation on integer field, with ES 6 (migrated from 5.x) on Debian 9.

Here is a first request I do, in order to assert that I do not have any data \> 60:

```
{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "media_id": "aaa"
          }
        },
        {
          "range": {
            "eng.visu": {
              "gte": 60
            }
          }
        }
      ]
    }
  },
  "size": 9999
} 

```

Result is as expected:

```
{
"took": 483,
"timed_out": false,
"_shards": {
  "total": 5,
  "successful": 5,
  "skipped": 0,
  "failed": 0
},
"hits": {
  "total": 0,
  "max_score": null,
  "hits": []
}

```

}

But then, I do a terms aggregation on those data:

```
{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "media_id": "aaa"
          }
        }
      ]
    }
  },
  "aggs": {
    " __all__": {
      "terms": {
        "field": "eng.visu",
        "size": 9999
      }
    }
  },
  "size": 0
}

```

And the result:

```
{
"took": 24,
"timed_out": false,
"_shards": {
  "total": 5,
  "successful": 5,
  "skipped": 0,
  "failed": 0
},
"hits": {
  "total": 18670,
  "max_score": 0,
  "hits": []
},
"aggregations": {
    " __all__": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1,
          "doc_count": 690
        },
        {
          "key": 0,
          "doc_count": 674
        },
        {
          "key": 2,
          "doc_count": 655
        },
        ...
       {
          "key": 80,
          "doc_count": 298
       },
      {
          "key": 82,
          "doc_count": 298
       },
       ...
       {
          "key": 5276,
          "doc_count": 1
        }
      ]
   }
}
}

```

As you can see, I have keys that are really greater than 60.

Has someone already seen this behaviour, and have a clue to fix it ?

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [December 12, 2017, 5:28pm UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/2 "2017-12-12T17:28:47Z")

</div>

What does the entire response look like? (including total hits)

---

<div class="post-metadata">

**Author:** ![fvilpoix](https://avatars.discourse-cdn.com/v4/letter/f/22d042/32.png) [@fvilpoix](https://discuss.elastic.co/u/fvilpoix)\
**Post date:** [December 13, 2017, 8:05am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/3 "2017-12-13T08:05:10Z")

</div>

Hi, thank your for your answer. I've updated the original post to include full content of both responses.

---

<div class="post-metadata">

**Author:** ![jpountz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpountz/32/45836_2.png) [@jpountz](https://discuss.elastic.co/u/jpountz)\
**Post date:** [December 13, 2017, 8:29am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/4 "2017-12-13T08:29:40Z")

</div>

This looks wrong indeed. Is it 100% reproducible? Can you find the document that has `5276` as a value for `eng.visu` somehow?

---

<div class="post-metadata">

**Author:** ![fvilpoix](https://avatars.discourse-cdn.com/v4/letter/f/22d042/32.png) [@fvilpoix](https://discuss.elastic.co/u/fvilpoix)\
**Post date:** [December 13, 2017, 10:22am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/5 "2017-12-13T10:22:43Z")

</div>

yes, there are documents with the value 5276 (~14K), but none with the media\_id filtered on "aaa".

---

<div class="post-metadata">

**Author:** ![fvilpoix](https://avatars.discourse-cdn.com/v4/letter/f/22d042/32.png) [@fvilpoix](https://discuss.elastic.co/u/fvilpoix)\
**Post date:** [January 2, 2018, 8:25am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/6 "2018-01-02T08:25:25Z")

</div>

Updated to 6.1.1 and still have the wrong behaviour.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2018, 8:25am UTC](https://discuss.elastic.co/t/terms-aggregation-shows-up-irrevelant-data/111287/7 "2018-01-30T08:25:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.