# When are “buckets”: \[\] in an aggregation?
**URL:** https://discuss.elastic.co/t/when-are-buckets-in-an-aggregation/122871
**Category:** Elasticsearch
**Created:** [March 7, 2018, 11:49am UTC](https://discuss.elastic.co/t/when-are-buckets-in-an-aggregation/122871 "2018-03-07T11:49:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@WoJ](https://discuss.elastic.co/u/WoJ)
#### Post date: [March 7, 2018, 11:49am UTC](https://discuss.elastic.co/t/when-are-buckets-in-an-aggregation/122871/1 "2018-03-07T11:49:05Z")
My query is a nested aggregation
```
aggs: {
src: {
terms: {
field: "dst_ip",
size: 1000,
},
aggs: {
dst: {
terms: {
field: "a_field_which_changes",
size: 2000,
},
},
},
},
```
A typical doc the query is ran against is below (the mappings are all of type `keyword`)
```
{
"_index": "honey",
"_type": "event",
"_id": "AWHzRjHrjNgIX_EoDcfV",
"_score": 1,
"_source": {
"dst_ip": "10.101.146.166",
"src_ip": "10.10.16.1",
"src_port": "38",
}
},
```
There are actually two queries I make, one after the other. They differ by the value of `a_field_which_changes`, which is `"src_ip"` in one query and `"src_port"` in the other.
In the first query all the results are fine. The aggregation is 1 element large and the buckets specify what that element matched with
```
{
"key": "10.6.17.218", <--- "dst_ip" field
"doc_count": 1,
"dst": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "-1", <--- "src_port" field
"doc_count": 1
}
]
}
},
```
The other query yields two different kind of results:
```
{
"key": "10.6.17.218",
"doc_count": 1,
"dst": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": []
}
},
{
"key": "10.237.78.19",
"doc_count": 1,
"dst": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "10.12.67.89",
"doc_count": 1
}
]
}
},
```
The first result is problematic: it does not give the details of the buckets. It is no different from the other one but somehow the details are missing.
**Why is it so, and most importantly - how to force Elasticsearch to display the details of the buckets?**
The [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) goes into details on how to interfere with the aggregation but I could not find anything relevant there.
(initially asked on [SO](https://stackoverflow.com/questions/49135194/when-are-buckets-in-an-aggregation))
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 4, 2018, 11:49am UTC](https://discuss.elastic.co/t/when-are-buckets-in-an-aggregation/122871/2 "2018-04-04T11:49:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.