Q:

Nested Child Aggregation returns "wrong" Parent doc_count

I have been trying for quite a while but cannot see the Problem. I would be very pleased if someone with more experience in ES can hint me in the right direction. I have have a parent type (College) and a child type (course). Courses have a 3 level nested aggregations (Subjectgroup). Now I am trying to show how many Colleges exists that offer Courses with the individual Subjectgroups within a College query. 
Here is my mapping:
indexes:
    studiengaenge:
        index_name: studiengaenge_dev
        settings:
            index:
                analysis:
                    analyzer:
                        lc_term:
                            type: custom
                            tokenizer: keyword
                            filter: lowercase
        types:
            college:
                mappings:
                    id: ~
            course:
                mappings:
                    id: ~
                    name: ~
                    subjectgroups:
                        type: "nested"
                        properties:
                            name: { "type": "string", "index": "analyzed", "analyzer": "lc_term" }
                            area:
                                type: "nested"
                                properties:
                                    name: { "type": "string", "index": "analyzed", "analyzer": "lc_term" }
                                    field:
                                        type: "nested"
                                        properties:
                                            name: { "type": "string", "index": "analyzed", "analyzer": "lc_term" }
                _parent:
                    type: "college"

The query:

GET college/_search?search_type=count
{
  "query": {
    "has_child": {
      "type": "course",
      "query": {
        "filtered": {
          "query": {
            "match_all": {}
          },
          "filter": {
            "bool": {
              "must": [
                {
                  "nested": {
                    "path": "subjectgroups",
                    "filter": {
                      "terms": {
                        "subjectgroups.name": [
                          "lehramt"
                        ]
                      }
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "aggs": {
    "children": {
      "children": {
        "type": "course"
      },
      "aggs": {
        "fachgruppen": {
          "nested": {
            "path": "course.subjectgroups"
          },
          "aggs": {
            "filtered": {
              "filter": {
                "terms": {
                  "subjectgroups.name": [
                    "lehramt"
                  ]
                }
              },
              "aggs": {
                "fachgruppe": {
                  "terms": {
                    "field": "subjectgroups.name"
                  },
                  "aggs": {
                    "reverse_nested": {
                      "reverse_nested": {},
                      "aggs": {
                        "doc_count_college": {
                          "cardinality": {
                            "field": "_parent"
                          }
                        }
                      }
                    },
                    "studienbereich": {
                      "nested": {
                        "path": "course.subjectgroups.area"
                      },
                      "aggs": {
                        "studienbereich": {
                          "terms": {
                            "field": "subjectgroups.area.name"
                          },
                          "aggs": {
                            "reverse_nested": {
                              "reverse_nested": {},
                              "aggs": {
                                "doc_count_college": {
                                  "cardinality": {
                                    "field": "_parent"
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

The result:

{
   "took": 7,
   "timed_out": false,
   "_shards": {
      "total": 1,
      "successful": 1,
      "failed": 0
   },
   "hits": {
      "total": 123,
      "max_score": 0,
      "hits": []
   },
   "aggregations": {
      "children": {
         "doc_count": 12289,
         "fachgruppen": {
            "doc_count": 15029,
            "filtered": {
               "doc_count": 4582,
               "fachgruppe": {
                  "doc_count_error_upper_bound": 0,
                  "sum_other_doc_count": 0,
                  "buckets": [
                     {
                        "key": "lehramt",
                        "doc_count": 4582,
                        "reverse_nested": {
                           "doc_count": 3786,
                           "doc_count_college": {
                              "value": 124
                           }
                        },
                        "studienbereich": {
                           "doc_count": 4582,
                           "studienbereich": {
                              "doc_count_error_upper_bound": 0,
                              "sum_other_doc_count": 0,
                              "buckets": [
                                 {
                                    "key": "schulische fächer",
                                    "doc_count": 3938,
                                    "reverse_nested": {
                                       "doc_count": 3399,
                                       "doc_count_college": {
                                          "value": 130
                                       }
                                    }
                                 },
                                 {
                                    "key": "berufliche fachrichtungen",
                                    "doc_count": 357,
                                    "reverse_nested": {
                                       "doc_count": 315,
                                       "doc_count_college": {
                                          "value": 105
                                       }
                                    }
                                 },
                                 {
                                    "key": "sonderpädagogik, inklusive pädagogik",
                                    "doc_count": 287,
                                    "reverse_nested": {
                                       "doc_count": 287,
                                       "doc_count_college": {
                                          "value": 32
                                       }
                                    }
                                 }
                              ]
                           }
                        }
                     }
                  ]
               }
            }
         }
      }
   }
}

The problem is that even though there are only 123 Results (Colleges), the Aggregation of the 2nd level subjectgroup tells me that there are 130 Colleges "key": "schulische fächer". 
Any help is greatly appreciated. Thanks, Hannes

A:

The problem in this case is that elasticsearch is not necessarily exact on aggregation counts. Elasticsearch might disregard a shard altogether if it thinks that the results of an aggregation will not be influenced greatly by the results that this specific shard might return. 
This will lead to only approximate results of aggregations. Try setting the index parameters in a way that there is only one shard for your data. Then the results will probably be different and possibly exact. This however is not a solution, because if you have a lot of data you'll need to spread it over different shards.
This properties of elasticsearch are drawback for the otherwise unparalleled speed when it comes to aggregations and other operations. 

