Elasticsearch - Range query work wrong

Question

I used kibana DEV Tools to query some range data,but there have 2 hits is out of my expectation,why it happens?

image of the range query

the query:

{
    "query" : {
        "constant_score" : { 
            "filter" : {
                "range" : { 
                    "rss" : {
                      "gte": 3000000
                    }
                }
            }
        }
    }
}

the result:

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 69,
        "successful": 69,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 2,
        "max_score": 1,
        "hits": [
            {
                "_index": "BBQ",
                "_type": "BBQ",
                "_id": "AWGJaCYkk-tGbWgj2e6R",
                "_score": 1,
                "_source": {
                    "message": [
                        "nodeProcessInfo"
                    ],
                    "@timestamp": "2018-02-12T09:45:59.525Z",
                    "rss": "92636",
                    "@version": "1",
                    "host": "192.168.213.96"
                }
            },
            {
                "_index": "BBQ",
                "_type": "BBQ",
                "_id": "AWGJaJxzk-tGbWgj2e-V",
                "_score": 1,
                "_source": {
                    "message": [
                        "nodeProcessInfo"
                    ],
                    "@timestamp": "2018-02-12T09:46:29.680Z",
                    "rss": "85272",
                    "@version": "1",
                    "host": "192.168.213.96"
                }
            }
        ]
    }
}

The result of range query is not in my expectation, why gte => 3000000 but rss = 92636 appeared?

======================edit at 2018.2.13=========（1）

the log like this:

"nodeProcessInfo|auth-server-1|auth|9618|1.9|1.2|98060|2018-2-12 6:33:43 PM|"

the filter like this:

filter {
if "nodeProcessInfo" in [message] {  
    mutate {
        split => ["message", "|"]
            add_field => {
                "serverId" => "%{[message[1]]}"
            }
            add_field => {
                "serverType" => "%{[message[2]]}"
            }
            add_field => {
                "pid" => "%{[message[3]]}"
            }
            add_field => {
                "cpuAvg" => "%{[message[4]]}"
            }
            add_field => {
                "memAvg" => "%{[message[5]]}"
            }
            add_field => {
                "rss" => "%{[message[6]]}"
            }
            add_field => {
                "time" => "%{[message[7]]}"
            }
        convert => ["rss", "integer"] # I try convert rss to int, but failed
        add_tag => "nodeProcessInfo"
    }

}

}

======================edit at 2018.2.13=========（2）

I let the convert code in a new mutate, and it worked to make "rss" into int type,but the result of range query also wrong,the change code like this:

if "nodeProcessInfo" in [message] {  
        mutate {
            split => ["message", "|"]
                ...
                ...
                add_field => {
                    "rss" => "%{[message[6]]}"
                }
        }
        mutate {
            convert => ["rss", "integer"] # add a new mutate here
        }
    }

======================edit at 2018.2.13=========（3）

At last I found the reason why rss'type is converted to int but range query also wrong:

"You can't change existing mapping type, you need to create a new index with the correct mapping and index the data again."

so I create a new field name to instead of rss and the result of range query is right now.

Answer 1

Can you share the mapping of the index.

I thing the problem is as i can see in the search results which you have shared , the type of the rss field is text or string.

If it is so then the range query you are using is treating them as string characters and giving you results according to that.

And what you are trying to use is number ranges which will work if you index data with type of rss field as long and then fire the same query.

You would then get the desired reuslts