Wrong results on Terms Aggregations

Elastic Stack Elasticsearch
#1

Hi,

I have two fields request_url (analysed) and *url_report (not_analysed)
. *Both has the same content .

The index has only one shard. The following is the aggregations query ,

{"from": 0,"size": 0, "query": {
"bool": {
"must": {
"query_string": {
"query": "request_url:"login"",
"default_operator": "and"
} } } },
"aggregations": {
"unique_url_report_count": {
"cardinality": {
"field": "url_report"
}},
"unique_url_report_values": {
"terms": {
"field": "url_report",
"size": 1000
}}}}

The ElasticSearch response is,

  • took: 312 timed_out: false
  • _shards: { total: 1 successful: 1 failed: 0}
  • hits: {total: 5711 max_score: 0 hits: [ ]}
  • aggregations: {
    • unique_url_report_count: { value: 3}
    • unique_url_report_values: {

    • buckets: [

      - { key: /login
   - doc_count: 5708
}
- {
- 
   - key: /ui/settings/login-history.jsp
   - doc_count: 2
}
- {
   - key: /home
   - doc_count: 1
}
      ]}}}

The first 2 buckets are ok since it has login , but the 3rd bucket seems
wrong . Am i missing anything ?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

#2

Can you try to find the document that matched although it should not, and
call the explain API on it to see why it matched?
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/search-explain.html

On Mon, Nov 17, 2014 at 8:25 AM, Anantha Govindarajan <
ananthagovindarajan@gmail.com> wrote:

Hi,

I have two fields request_url (analysed) and *url_report
(not_analysed) . *Both has the same content .

The index has only one shard. The following is the aggregations query ,

{"from": 0,"size": 0, "query": {
"bool": {
"must": {
"query_string": {
"query": "request_url:"login"",
"default_operator": "and"
} } } },
"aggregations": {
"unique_url_report_count": {
"cardinality": {
"field": "url_report"
}},
"unique_url_report_values": {
"terms": {
"field": "url_report",
"size": 1000
}}}}

The ElasticSearch response is,

  • took: 312 timed_out: false
  • _shards: { total: 1 successful: 1 failed: 0}
  • hits: {total: 5711 max_score: 0 hits: [ ]}
  • aggregations: {
    • unique_url_report_count: { value: 3}
    • unique_url_report_values: {

    • buckets: [

      - { key: /login
   - doc_count: 5708
}
- {
-
   - key: /ui/settings/login-history.jsp
   - doc_count: 2
}
- {
   - key: /home
   - doc_count: 1
}
      ]}}}

The first 2 buckets are ok since it has login , but the 3rd bucket seems
wrong . Am i missing anything ?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
Adrien Grand

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j5jyJbKxTOz5ERR-NwfJzX0w14Y-ttCb9CwgdwFj7awew%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

#3

Hi Adrien,

This bug caused due to our application threading issue. Sorry for the wrong
question.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e9f56411-47f1-4191-9ea2-470623990d93%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

#4