# Troubleshooting Elasticsearch queries **URL:** \ **Category:** Elasticsearch\ **Created:** [April 30, 2015, 12:45pm UTC](https://discuss.elastic.co/t/troubleshooting-elasticsearch-queries/23489 "2015-04-30T12:45:18Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![trekr5](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@trekr5](https://discuss.elastic.co/u/trekr5)\ **Post date:** [April 30, 2015, 12:45pm UTC](https://discuss.elastic.co/t/troubleshooting-elasticsearch-queries/23489/1 "2015-04-30T12:45:18Z")
Hi, I've included my gist here [https://gist.github.com/trekr5/db0b0f577cab10d95257](https://gist.github.com/trekr5/db0b0f577cab10d95257). I'm trying to extract the number of status 500 errors from an ElasticSearch server over a 2 hour period. The problem is that the query returns too many records. I should be receiving 272 errors over a 2 hour time period. Instead I'm getting 1.5M. I'm very new to ElasticSearch so am unsure if my query is correct. All assistance much appreciated. Regards -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 30, 2015, 1:20pm UTC](https://discuss.elastic.co/t/troubleshooting-elasticsearch-queries/23489/2 "2015-04-30T13:20:32Z")
I think you said that it returns 1.5M records because you saw that in total\_hits field, right? This is because you did write any query but only a facet. So the resultset is the full dataset for this index. I would write something like this: [gist:0b161423d0acafecb012 · GitHub](https://gist.github.com/dadoonet/0b161423d0acafecb012) [https://gist.github.com/dadoonet/0b161423d0acafecb012](https://gist.github.com/dadoonet/0b161423d0acafecb012) -- David Pilato - Developer | Evangelist > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co/)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > Le 30 avr. 2015 à 14:45, trekr5 [cebirim@gmail.com](mailto:cebirim@gmail.com) a écrit : > > Hi, > > I've included my gist here [gist:db0b0f577cab10d95257 · GitHub](https://gist.github.com/trekr5/db0b0f577cab10d95257). > > I'm trying to extract the number of status 500 errors from an Elasticsearch server over a 2 hour period. The problem is that the query returns too many records. I should be receiving 272 errors over a 2 hour time period. Instead I'm getting 1.5M. > > I'm very new to Elasticsearch so am unsure if my query is correct. > > All assistance much appreciated. > > Regards > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com) [https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/9769836c-d0fe-4c4f-89e6-45f4ea1b75ed%40googlegroups.com?utm_medium=email&utm_source=footer). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout) [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/61725BBF-6C76-41DF-8477-CF55712A64C3%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/61725BBF-6C76-41DF-8477-CF55712A64C3%40pilato.fr). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:16am UTC](https://discuss.elastic.co/t/troubleshooting-elasticsearch-queries/23489/3 "2017-07-06T00:16:44Z")
Closed on July 6, 2017, 12:16am UTC