Elasticsearch query gives different results from cURL and Kibana - elasticsearch

Question

I am a newbie in Elasticsearch and kibana and am trying to connect elasticsearch with PHP to generate some reports.
I am trying to run a query, which runs perfectly fine in kibana sense but surprisingly gives different results whenever I cURL it.
GET /_search
{
"query": {
"filtered": {
"query": {
"query_string": {
"query": "*",
"analyze_wildcard": true
}
},
"filter": {
"bool": {
"must": [
{
"query": {
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
}
},
{
"range": {
"start_time": {
"gte": 1532889000000,
"lte": 1532975399999,
"format": "epoch_millis"
}
}
}
],
"must_not": []
}
}
}
},
"size": 0,
"aggs": {
"2": {
"terms": {
"field": "layers",
"size": 50,
"order": {
"_count": "desc"
}
}
}
}
}
When I cURL this query, it returns documents instead of aggregate results.
Where am I going wrong?
TIA
EDIT: I am working on Elasticsearch 2.3
The PHP Code I am running to retrieve the results:
$jarray=array (
'query' =>
array (
'filtered' =>
array (
'query' =>
array (
'query_string' =>
array (
'query' => '*',
'analyze_wildcard' => true,
),
),
'filter' =>
array (
'bool' =>
array (
'must' =>
array (
0 =>
array (
'query' =>
array (
'query_string' =>
array (
'analyze_wildcard' => true,
'query' => '*',
),
),
),
1 =>
array (
'range' =>
array (
'start_time' =>
array (
'gte' => 1532889000000,
'lte' => 1532975399999,
'format' => 'epoch_millis',
),
),
),
),
'must_not' =>
array (
),
),
),
),
),
'size' => 0,
'aggs' =>
array (
2 =>
array (
'terms' =>
array (
'field' => 'layer_count',
'size' => 50,
'order' =>
array (
'_count' => 'desc',
),
),
),
),
);
$jdata=json_encode($jarray);
$url = '10.10.113.97:9200/my_index/_search';
echo $url.'<br><br><br><br><br><br>';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_GETFIELDS, json_encode($jdata));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$return = curl_exec($ch) or die(curl_error());
curl_close($ch);
print_r(stripcslashes($return));

Answer 1

In your cURL code, you need to change the field you use in your aggregation section:
'aggs' =>
array (
2 =>
array (
'terms' =>
array (
'field' => 'layers', <--- change this line
'size' => 50,
'order' =>
array (
'_count' => 'desc',
),
),
),
),
Also you need to send your request like this. My worry is that you're sending a GET without any request body and ES will simply ignore your query and perform a generic search.
$query = json_encode($jdata);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_POSTFIELDS, $query);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($query))
);