You could try to run this:
curl -XGET "http://localhost:9200/index/_search" -d'
{
"post_filter": {
"not": {
"filter": {
"or": [
{
"term": {
"_type": "type1"
}
},
{
"term": {
"_type": "type2"
}
},
{
"term": {
"_type": "type3"
}
}
]
}
}
}
}'
--
David Pilato | Technical Advocate | elasticsearch.com
david.pilato@elasticsearch.com
@dadoonet | @elasticsearchfr | @scrutmydocs
Le 24 septembre 2014 à 08:47:41, bob.webman@gmail.com (bob.webman@gmail.com) a écrit:
And this is what I don't understand!
I tried that, and did an exclude on types 1,2 &3 and the result was nothing!
No missing and no 'other values'
The filters I did were of the form:
must not
field: _type
value: type1
I have just found something that might explain it to someone who understands this stuff!
If I filter to MATCH on 'field: _type' = 'type2' or 'type3' then the "other values" is 0
However if I filter on 'type1' then I get my 4 billion other values, so it is something to do with 'type1'
eg;
must
field: _type
value: type1
Term Count
type1 2142281401
Missing field 0
Other values 4294967296
With that in mind, how do I now troubleshoot further? I still don't understand.
On Wednesday, September 24, 2014 7:26:53 AM UTC+1, David Pilato wrote:
It basically means that in your "type" field you have a lot of 1, 2 and 3
And a lot of other values which are not 1, 2 or 3.
But this is obvious.
I guess you asked Kibana to give you only the TOP 3 values?
Try with 10 or 20 and you will See what other values could look like.
Also in Kibana, you can add a table panel and add filters which exclude type 1, type 2 and type 3.
So you will see your related documents in table panel.
HTH
--
David 
Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs
Le 24 sept. 2014 à 08:17, bob.w...@gmail.com a écrit :
I have loaded 3 of data onto my 4-node ES cluster using logstash. Everything seems to have worked nicely.
Stats are:
7,545,866,876 documents
58 indices
232 shards
4.7TB
However when I look at the data with Kibana I see the 3 types and a huge number of 'other values'.
Document types:
term '1' 2,142,281,401
term '2' 1,077,175,717
term '3' 31,442,462
Missing field 0
Other values 4,294,967,296
What is that 'other values' all about? Can anyone explain what it is and should I do anything about it?
Thanks
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/48ca6d39-e67f-4cf9-afac-3c5db871a365%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/etPan.54226e8e.79e2a9e3.3194%40MacBook-Air-de-David.local.
For more options, visit https://groups.google.com/d/optout.
