Two same aggregation generate different results

Elastic Stack Elasticsearch
1

i want to get the cardinallity of a field in an index whose data will not change. i think both dsl mentioned below have the same meaning. However, they generate different results.

{ "size" : 0, "query" : { "bool" : { "must" : [ { "term" : { "func" : "summarize" } }, { "range" : { "time" : { "from" : 1461513600000, "to" : 1462204800000, "include_lower" : true, "include_upper" : true } } } ] } }, "aggregations" : { "useCount" : { "cardinality" : { "field" : "session" } } } }

{
"size" : 0,
"query" : {
"bool" : {
"must" : [ {
"term" : {
"func" : "summarize"
}
}, {
"range" : {
"time" : {
"from" : 1461513600000,
"to" : 1462204800000,
"include_lower" : true,
"include_upper" : true
}
}
} ]
}
},
"aggregations" : {
"func" : {
"terms" : {
"field" : "func",
"size" : 1000
},
"aggregations" : {
"useCount" : {
"cardinality" : {
"field" : "session"
}
}
}
}
}
}

i think it is similar to next two sql:
select count(distinct field1) from index where field2='xxx';
select count(distinct field1) from index where field2='xxx' group by field2;