Why i got different result of aggregation?

[Zoree]

I have queries with aggregation, the query section is the same for both, but the aggregation section is a little different and I don't understand why the different results are coming.

agg1:

{
    "aggs": {
        "Metrics": {
            "filter": {
                "match_all": {}
            },
            "aggs": {
                "double": {
                    "filter": {
                        "term": {
                            "is_double": true
                        }
                    }
                },
                "pub": {
                    "filter": {
                        "match_all": {}
                    }
                },
                "theme": {
                    "cardinality": {
                        "field": "tfidf_parent_id"
                    }
                },
                "site": {
                    "cardinality": {
                        "field": "site_id"
                    }
                }
            }
        }
    }
}

agg2:

{
    "aggs": {
        "date": {
            "date_histogram": {
                "field": "created",
                "interval": "hour",
                "format": "yyyy-MM-dd HH:mm:ss.SSSSSS",
                "extended_bounds": {
                    "min": "2025-05-22 00:00:00.000000",
                    "max": "2025-05-22 23:59:59.999000"
                }
            },
            "aggs": {
                "Metrics": {
                    "filter": {
                        "match_all": {}
                    },
                    "aggs": {
                        "double": {
                            "filter": {
                                "term": {
                                    "is_double": true
                                }
                            }
                        },
                        "pub": {
                            "filter": {
                                "match_all": {}
                            }
                        },
                        "theme": {
                            "cardinality": {
                                "field": "tfidf_parent_id"
                            }
                        },
                        "site": {
                            "cardinality": {
                                "field": "site_id"
                            }
                        }
                    }
                }
            }
        }
    }
}

in query section this have equal time range, but aggregation result is different. For first case is 912 for next is 948, its a sum of "site" bucket

[carly.richmond]

Hi @Zoree,

Which version of Elasticsearch are you using? For agg2 I had to change the query to use calendar_interval instead of interval to make it work.

What is the range of dates that you run the original aggregation over? Looking at the documentation for extended_bounds I can see that option forces the min and max ranges for the buckets, which could lead to different results.

Have you tried comparing the output of the Search Profiler or the _profile API to inspect the execution?

Giving it a go myself the difference is the date histogram layer:

agg1:

agg2:

Hope that helps!