Elasticsearch aggregation count mismatch - elasticsearch

Question

I am getting improper aggregation count from ES query. I understand from ES documentation cardinality and term aggregations are not accurate but which i got is having too much difference.
Mapping of my index is
{
"dynamic_templates": [{
"template_action": {
"mapping": {
"type": "string",
"index": "not_analyzed"
},
"match": "*",
"match_mapping_type": "*"
}
}],
"_parent": {
"type": "users"
},
"date_detection": False,
"properties": {
"traits": {
"type": "object"
},
"cl_utm_params": {
"type": "object"
},
"cl_other_params": {
"type": "object"
},
"cl_triggered_ts": {
"type": "date"
}
}
}
a sample document
{
"client_id": "cl58vivh8w7t",
"user_id": "CL.1122029143.1904488380.1218174474.2049762488",
"session_id": "CL.1886305621.906039613",
"source": "Google",
"action": "pageview",
"cl_triggered_ts": "2016-09-09T00:13:33.818Z",
"browser": "Microsoft Edge 13",
"platform": "Windows 10",
"screen_size": "1920 x 1080",
"device": "Desktop",
"ip_address": "98.236.246.165",
"country": "United States",
"city": "Weirton",
"postal_code": "26062",
"location": "40.4224, -80.5739",
"timezone": "America/New_York",
"state": "West Virginia",
"continent": "North America",
"isp": "Comcast Cable",
"browser_language": "",
"traits": {},
"cl_utm_params": {},
"cl_other_params": {}
}
from below query i am getting unique no of sessions for each source and unique no of sessions for each device by source using bucket and metric aggregations
{
"query": {
"bool": {
"must": [
{"match": {"client_id": "cl58vivh8w7t"}}
]
}
},
"aggs": {
"top_source": {
"terms": {
"field": "source"
},
"aggs": {
"total_unique_sessions": {"cardinality": {"field": "session_id"}},
"per_device": {
"terms": {"field": "device"},
"aggs": {"device_session": {"cardinality": {"field": "session_id"}}}
}
}
}
},
"size": 0
}
for reference i have given a single bucket below. from this the sum of each device's session value should be equal to the total_unique_sessions value.
I suspect is there something wrong with my query or my calculations?
{
"key": "www.google.com",
"doc_count": 68947,
"per_device": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"key": "Desktop",
"doc_count": 49254,
"device_session": {
"value": 2413
}
},
{
"key": "Mobile",
"doc_count": 16317,
"device_session": {
"value": 3222
}
},
{
"key": "Tablet",
"doc_count": 3343,
"device_session": {
"value": 636
}
},
{
"key": "TV",
"doc_count": 33,
"device_session": {
"value": 9
}
}
]
},
"total_unique_sessions": {
"value": 9058
}
}

Answer 1

I see you have are using match query.
Normally we do term query for aggregation. I think match is causing this problem.
{
"query": {
"bool": {
"must": [
{"term": {"client_id": "cl58vivh8w7t"}}
]
}
},
"aggs": {
"top_source": {
"terms": {
"field": "source"
},
"aggs": {
"total_unique_sessions": {"cardinality": {"field": "session_id"}},
"per_device": {
"terms": {"field": "device"},
"aggs": {"device_session": {"cardinality": {"field": "session_id"}}}
}
}
}
},
"size": 0
}