elasticsearch - Filter facet returns count of all documents and not range -

i'm using elasticsearch , nest create query documents within specific time range doing filter facets. query looks this:

{   "facets": {     "notfound": {       "query": {         "term": {           "statuscode": {             "value": 404           }         }       }     }   },   "filter": {     "bool": {       "must": [         {           "range": {             "time": {               "from": "2014-04-05t05:25:37",               "to": "2014-04-07t05:25:37"             }           }         }       ]     }   } } 

in specific case, total hits of search 21 documents, fits documents within time range in elasticsearch. "notfound" facet returns 38, fits total number of errordocuments statuscode value of 404.

as understand documentation, facets collects data withing search. in case, "notfound" facet should never able return count higher 21.

what doing wrong here?

there's distinct difference between filter/query/filtered_query/facet filter know.

top level filter

{     filter: {} } 

this acts post-filter, meaning filter results after query phase has ended. since facets part of query phase filters not influence documents facetted over. filters not alter score , therefor cacheable.

top level query

{     query: {} } 

queries influence score of document , therefor less cacheable filters. queries run in query phase , influence documents facetted over.

filtered query

{     query: {         filtered: {            filter: {}            query: {}         }     } } 

this allows run filters in query phase taking advantage of better cacheability , have them influence documents facetted over.

facet filter

"facets" : {     "<facet name>" : {         "<facet type>" : {             ...         },         "facet_filter" : {             "term" : { "user" : "kimchy"}         }     } } 

this allows apply filter documents facet run over. remember it'll combination of queryphase/facetfilter unless specify global:true on facet well.

query facet/filter facet

{     "facets" : {         "wow_facet" : {             "query" : {                 "term" : { "tag" : "wow" }             }         }     } } 

which 1 @thomasardal using in case fine, it's facet type returns single value: query hit count.

the fact query facet returns 38 , not 21 because use filter time range.

you can fix either doing filter in filtered_query in query phase or apply facet filter(not filter_facet) query_facet although because filters cached better better use facet filter inside filter facet.

confusingly filter facets specified using .facetfilter() on search object. change in 1.0 avoid future confusion.

sadly: .facetfilter() , .facetquery() in nest not allow specify facet filter can other facets:

var results = typedclient.search<object>(s => s     .facetterm(ft=>ft         .onfield("myfield")         .facetfilter(f=>f.term("filter_facet_on_this_field", "value"))     ) );