ElasticSearch: scoped aggregation

Question

My understanding is that I can apply aggs to the scope of the query. If I run the query only, it brings back 21K hits. However, when I add aggs to it, it comes back empty. What am I doing wrong?

Thank you,

{
  "query": {
    "bool": {
      "must": [
         { "term": {"app.raw": "ME"} }
        ,{ "term": {"cat.raw": "IV"} }
        ,{ "term": {"sub.raw": "Act"} }
      ]
    }
  }
,
  "aggs": {
    "distinct_users": {
      "cardinality": {
        "field": "login",
        "precision_threshold": 1000
      }
    }
  }  
}

Answer 1

Because your request to elasticsearch has an "aggs" parameter, the "size" parameter defaults to 0 and query results are not returned, only aggregation results.

Add a "size" field with whatever value you want to the topmost object in the query to also return search hits, e.g.

{
  query: {
    ...
  },
  size: 42,
  aggs: {
    ...
  }
}