Elasticsearch filtering for the same range brings back different amount of results
<p>I want to perform the following query</p>

<pre><code>SELECT * 
FROM logs
WHERE dst != "-" 
AND @timestamp &gt; "a date before" AND @timestamp &lt; "now"
</code></pre>

<p>I use python elasticsearch sdk, and formed two queries for testing</p>

<pre><code>from elasticsearch import Elasticsearch
from datetime import datetime, timedelta

now = datetime.now()
four_hours_before = now - timedelta(hours=4)

es = Elasticsearch("http://es.domain.com:9200")

query_bool_filter = {
    'query': {
        'bool': {'
             filter': {
                 'bool': {
                     'must_not': {
                         'term': {
                             'dst': '-'
                          }
                      }, 
                      'must': {
                          'range': {
                              '@timestamp': {
                                  'gte': four_hours_before, 
                                  'lte': now
                                  }
                              }
                          }
                      }
                  }
              }
          }
      }
</code></pre>

<p>and a second query that uses the must_not separate from the filter</p>

<pre><code>query_bool_and_filter = {
    'query': {
        'bool': {
            'filter': {
                'range': {
                    '@timestamp': {
                        'gte': four_hours_before, 
                        'lte': now
                    }
                }
            },
            'must_not': {
                'term': {
                    'dst': '-'
                }
            }
        }
    }
}
</code></pre>

<p>When I execute the queries using search from the python sdk I and compare total field in the returning results and it's different like so:</p>

<pre><code>res1 = es.search(index="myindex", body=query_bool_filter)
res2 = es.search(index="myindex", body=query_bool_and_filter)

res1.get('hits').get('total') #prints 43197
res2.get('hits').get('total') #prints 43215
</code></pre>

<p>Why do I get different numbers since the range is the same?</p>

<p>You can try <a href="https://www.elastic.co/guide/en/elasticsearch/guide/current/logging.html" rel="nofollow">logging</a> to see what is really happening with your elastic search queries.</p>

python elasticsearch