Elasticsearch query gives different results from cURL and Kibana

I am a newbie in Elasticsearch and kibana and am trying to connect elasticsearch with PHP to generate some reports.

I am trying to run a query, which runs perfectly fine in kibana sense but surprisingly gives different results whenever I cURL it.

GET /_search
{
  "query": {
    "filtered": {
      "query": {
        "query_string": {
          "query": "*",
          "analyze_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "query": {
                "query_string": {
                  "analyze_wildcard": true,
                  "query": "*"
                }
              }
            },
            {
              "range": {
                "start_time": {
                  "gte": 1532889000000,
                  "lte": 1532975399999,
                  "format": "epoch_millis"
                }
              }
            }
          ],
          "must_not": []
        }
      }
    }
  },
  "size": 0,
  "aggs": {
    "2": {
      "terms": {
        "field": "layers",
        "size": 50,
        "order": {
          "_count": "desc"
        }
      }
    }
  }
}

When I cURL this query, it returns documents instead of aggregate results.

Where am I going wrong? TIA

EDIT: I am working on Elasticsearch 2.3

The PHP Code I am running to retrieve the results:

$jarray=array (
    'query' =>
        array (
            'filtered' =>
                array (
                    'query' =>
                        array (
                            'query_string' =>
                                array (
                                    'query' => '*',
                                    'analyze_wildcard' => true,
                                ),
                        ),
                    'filter' =>
                        array (
                            'bool' =>
                                array (
                                    'must' =>
                                        array (
                                            0 =>
                                                array (
                                                    'query' =>
                                                        array (
                                                            'query_string' =>
                                                                array (
                                                                    'analyze_wildcard' => true,
                                                                    'query' => '*',
                                                                ),
                                                        ),
                                                ),
                                            1 =>
                                                array (
                                                    'range' =>
                                                        array (
                                                            'start_time' =>
                                                                array (
                                                                    'gte' => 1532889000000,
                                                                    'lte' => 1532975399999,
                                                                    'format' => 'epoch_millis',
                                                                ),
                                                        ),
                                                ),
                                        ),
                                    'must_not' =>
                                        array (
                                        ),
                                ),
                        ),
                ),
        ),
    'size' => 0,
    'aggs' =>
        array (
            2 =>
                array (
                    'terms' =>
                        array (
                            'field' => 'layer_count',
                            'size' => 50,
                            'order' =>
                                array (
                                    '_count' => 'desc',
                                ),
                        ),
                ),
        ),
);



$jdata=json_encode($jarray);
$url = '10.10.113.97:9200/my_index/_search';
echo $url.'<br><br><br><br><br><br>';




$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_GETFIELDS, json_encode($jdata));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$return = curl_exec($ch) or die(curl_error());
curl_close($ch);
print_r(stripcslashes($return));

In your cURL code, you need to change the field you use in your aggregation section:

'aggs' =>
    array (
        2 =>
            array (
                'terms' =>
                    array (
                        'field' => 'layers',         <--- change this line
                        'size' => 50,
                        'order' =>
                            array (
                                '_count' => 'desc',
                            ),
                    ),
            ),
    ),

Also you need to send your request like this. My worry is that you're sending a GET without any request body and ES will simply ignore your query and perform a generic search.

$query = json_encode($jdata);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");                                                                     
curl_setopt($ch, CURLOPT_POSTFIELDS, $query);                                                                  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);                                                                      
curl_setopt($ch, CURLOPT_HTTPHEADER, array(                                                                          
    'Content-Type: application/json',                                                                                
    'Content-Length: ' . strlen($query))                                                                       
);