Use the same query return different hits total

Elastic Stack Elasticsearch
1

Hi：
I use a very simple query to search a index which is last day and has no documents income. but I got
a different hits total , I don't know why?

The query:

GET app-wechat-2018.04.16/_search?preference=_primary
  {
    "query": {
         "match": {
            "message": "maidian" 
        }
        
    }
}

one result:

{
  "took": 76,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 29579,
    "max_score": 4.108034,
    "hits": [
      {
        "_index": "app-wechat-2018.04.16",
        "_type": "app",
        "_id": "AWLLw-xdv1eGfmvVhTgH",
        "_score": 4.108034,
        "_source": {
          "log_type": "app",
          "@timestamp": "2018-04-16T00:03:21.263Z",
          "ip": "10.125.70.26",
          "beat": {},
          "@version": "1",
          "name": "wechat",
          "source": "/home/finance/Logs/wechat.msxf.lo/log-2018-04-16.log",
          "tag": "log-2018-04-16",
          "message": """2018-04-16 08:03:21.007 [INFO] dateFileLog - {"maidian":"maidianp","usr_id":"6033147","union_id":"133a72633f884c74950be71f820f6d8b","open_id":"o9NCRv2Svm1PUxenZ8EunVB-9HNQ","appl_termn":"WeChat","appl_no":"870682478958874632","prod_cd":"1101","page_id":"htsb","last_page_id":"yxzl","next_page_id":"szmm","entr_tm":"2018-04-16 08:03:20.998","leave_tm":"","usr_reg_tm":"","partner_type":"","partner_ver":"","app_chan":"","app_pkg":"","os_ver":"","device_uniq_id":"","device_md":"","device_gps":"","device_ip":""}""",
          "type": "app"
        }
      },
      {
...

another result:

{
  "took": 3,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 29582,
    "max_score": 4.1081295,
    "hits": [
      {
        "_index": "app-wechat-2018.04.16",
        "_type": "app",
        "_id": "AWLLw-xdv1eGfmvVhTgH",
        "_score": 4.1081295,
        "_source": {
          "log_type": "app",
          "@timestamp": "2018-04-16T00:03:21.263Z",
          "ip": "10.125.70.26",
          "beat": {},
          "@version": "1",
          "name": "wechat",
          "source": "/home/finance/Logs/wechat.msxf.lo/log-2018-04-16.log",
          "tag": "log-2018-04-16",
          "message": """2018-04-16 08:03:21.007 [INFO] dateFileLog - {"maidian":"maidianp","usr_id":"6033147","union_id":"133a72633f884c74950be71f820f6d8b","open_id":"o9NCRv2Svm1PUxenZ8EunVB-9HNQ","appl_termn":"WeChat","appl_no":"870682478958874632","prod_cd":"1101","page_id":"htsb","last_page_id":"yxzl","next_page_id":"szmm","entr_tm":"2018-04-16 08:03:20.998","leave_tm":"","usr_reg_tm":"","partner_type":"","partner_ver":"","app_chan":"","app_pkg":"","os_ver":"","device_uniq_id":"","device_md":"","device_gps":"","device_ip":""}""",
          "type": "app"
        }
      },
2

Does the count change when you keep the preference on _primary? Or does it change as soon as you dont specify any preference.

What Elasticsearch version is this?

3

Yes I keep it on _primary ,it will change, my ES version is 5.5.2, Can you tell me some reasons that will cause this problem so I can check my cluster！

4

I dont have a concrete idea yet why this can happen. Interestingly enough the scores are also different. When you add explain: true to your queries, you can see why the scores are different, maybe this uncovers a few more information.

I also assume, that you have a stable cluster where no allocations are happening?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.