Wrong results on Terms Aggregations

Elastic Stack Elasticsearch
1

Hi,

I have two fields request_url (analysed) and *url_report (not_analysed)
. *Both has the same content .

The index has only one shard. The following is the aggregations query ,

{"from": 0,"size": 0, "query": {
"bool": {
"must": {
"query_string": {
"query": "request_url:"login"",
"default_operator": "and"
} } } },
"aggregations": {
"unique_url_report_count": {
"cardinality": {
"field": "url_report"
}},
"unique_url_report_values": {
"terms": {
"field": "url_report",
"size": 1000
}}}}

The ElasticSearch response is,

  • took: 312 timed_out: false
  • _shards: { total: 1 successful: 1 failed: 0}
  • hits: {total: 5711 max_score: 0 hits: [ ]}
  • aggregations: {
    • unique_url_report_count: { value: 3}
    • unique_url_report_values: {

    • buckets: [

      - { key: /login
   - doc_count: 5708
}
- {
- 
   - key: /ui/settings/login-history.jsp
   - doc_count: 2
}
- {
   - key: /home
   - doc_count: 1
}
      ]}}}

The first 2 buckets are ok since it has login , but the 3rd bucket seems
wrong . Am i missing anything ?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

2

Can you try to find the document that matched although it should not, and
call the explain API on it to see why it matched?

On Mon, Nov 17, 2014 at 8:25 AM, Anantha Govindarajan <
ananthagovindarajan@gmail.com> wrote:

Hi,

I have two fields request_url (analysed) and *url_report
(not_analysed) . *Both has the same content .

The index has only one shard. The following is the aggregations query ,

{"from": 0,"size": 0, "query": {
"bool": {
"must": {
"query_string": {
"query": "request_url:"login"",
"default_operator": "and"
} } } },
"aggregations": {
"unique_url_report_count": {
"cardinality": {
"field": "url_report"
}},
"unique_url_report_values": {
"terms": {
"field": "url_report",
"size": 1000
}}}}

The Elasticsearch response is,

  • took: 312 timed_out: false
  • _shards: { total: 1 successful: 1 failed: 0}
  • hits: {total: 5711 max_score: 0 hits: }
  • aggregations: {
    • unique_url_report_count: { value: 3}
    • unique_url_report_values: {

    • buckets: [

      - { key: /login
   - doc_count: 5708
}
- {
-
   - key: /ui/settings/login-history.jsp
   - doc_count: 2
}
- {
   - key: /home
   - doc_count: 1
}
      ]}}}

The first 2 buckets are ok since it has login , but the 3rd bucket seems
wrong . Am i missing anything ?

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com
https://groups.google.com/d/msgid/elasticsearch/b725ab85-3fcb-4c3c-a8b1-f3eee20e6718%40googlegroups.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
Adrien Grand

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAL6Z4j5jyJbKxTOz5ERR-NwfJzX0w14Y-ttCb9CwgdwFj7awew%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Hi Adrien,

This bug caused due to our application threading issue. Sorry for the wrong
question.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e9f56411-47f1-4191-9ea2-470623990d93%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.