[BUG] terminate_after Parameter Impact on Dropdown List Query Results

[kaituo]

Describe the bug

I'm reaching out to report an inconsistency we've observed with the terminate_after parameter in our search queries, which seems to be affecting the functionality of dropdown lists in the frontend.

Issue Description:

The frontend utilizes a query that leverages the terminate_after parameter to calculate dropdown lists. This has been working as expected up to version 2.9. However, upon upgrading to version 2.11, the same query now returns empty results.

Query Example:

GET sensorsdata-*/_search
{
  "timeout": "1000ms",
  "terminate_after": 100000,
  "size": 0,
  "aggs": {
    "termsAgg": {
      "terms": {
        "order": { "_count": "desc" },
        "size": 500,
        "field": "Host.keyword"
      }
    }
  },
  "stored_fields": ["*"],
  "script_fields": {},
  "docvalue_fields": [{
    "field": "TimeStamp",
    "format": "date_time"
  }],
  "_source": { "excludes": [] },
  "query": { "bool": { "must": [], "filter": [], "should": [], "must_not": [] } }
}

Observations:

• Setting terminate_after to 0 or increasing the value to 500,000 results in the expected output.
• The default value of 100,000 for terminate_after has been a constant for over 4 years, as per our historical code reference here.

Potential Explanations:

• The index might contain more than 100,000 documents, but fewer than 500,000. Since terms aggregation requires scanning all documents, partial results are not feasible.
• Disabling terminate_after by setting it to 0 allows the query to scan all necessary documents to complete the aggregation.

Related Changes:

• In the 2.11 update, we identified a change that might be correlated with this issue, detailed in this pull request.

We need assistance in pinpointing the root cause of this discrepancy. Could you please help us investigate this matter further? Any insights into changes between versions 2.9 and 2.11 that could affect the terminate_after behavior would be invaluable.

Related component

Search:Aggregations

To Reproduce

1. Construct an index that contains a document count exceeding 100,000 yet remains below 500,000. Ensure each document includes the fields Host.keyword and TimeStamp.
2. run the following query:

GET sensorsdata-*/_search
{
  "timeout": "1000ms",
  "terminate_after": 100000,
  "size": 0,
  "aggs": {
    "termsAgg": {
      "terms": {
        "order": { "_count": "desc" },
        "size": 500,
        "field": "Host.keyword"
      }
    }
  },
  "stored_fields": ["*"],
  "script_fields": {},
  "docvalue_fields": [{
    "field": "TimeStamp",
    "format": "date_time"
  }],
  "_source": { "excludes": [] },
  "query": { "bool": { "must": [], "filter": [], "should": [], "must_not": [] } }
}

Expected behavior

We expect to see non-empty terms aggregation result.

Additional Details

No response

[peternied]

[Triage - attendees 1 2 3 4]
Thanks for filing, please feel free to submit a pull request.

[peternied]

@reta you mentioned there was a related issue that was resolved [1] could you take a look into this report?

• [1] [Concurrent Segment Search] NPE with size and terminate_after parameters when using concurrent search #10054