How do I retrieve more than 10000 results/events in Elastic-search

Question

Example query:

GET hostname:port /myIndex/_search {      "size": 10000,     "query": {         "term": { "field": "myField" }     } } 

I have been using the size option knowing that:

index.max_result_window = 100000

But if my query has the size of 650,000 Documents for example or even more, how can I retrieve all of the results in one GET?

I have been reading about the SCROLL, FROM-TO, and the PAGINATION API, but all of them never deliver more than 10K.

This is the example from Elasticsearch Forum, that I have been using:

GET /_search?scroll=1m 

Can anybody provide an example where you can retrieve all the documents for a GET search query?

Answer 1

Scroll is the way to go if you want to retrieve a high number of documents, high in the sense that it's way over the 10000 default limit, which can be raised.

The first request needs to specify the query you want to make and the scroll parameter with duration before the search context times out (1 minute in the example below)

POST /index/type/_search?scroll=1m {     "size": 1000,     "query": {         "match" : {             "title" : "elasticsearch"         }     } } 

In the response to that first call, you get a _scroll_id that you need to use to make the second call:

POST /_search/scroll  {     "scroll" : "1m",      "scroll_id" : "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ=="  } 

In each subsequent response, you'll get a new _scroll_id that you need to use for the next call until you've retrieved the amount of documents you need.

So in pseudo code it looks somewhat like this:

# first request response = request('POST /index/type/_search?scroll=1m') docs = [ response.hits ] scroll_id = response._scroll_id  # subsequent requests while (true) {    response = request('POST /_search/scroll', scroll_id)    docs.push(response.hits)    scroll_id = response._scroll_id } 

UPDATE:

Please refer to the following answer which is more accurate regarding the best solution for deep pagination: Elastic Search - Scroll behavior

Answer 2

Note that from + size can not be more than the index.max_result_window index setting which defaults to 10,000.

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/search-request-from-size.html

So You'll have TWO approches here:

1.add the your query the "track_total_hits": true variable.

GET index/_search {     "size":1,     "track_total_hits": true }

2.Use the Scroll API, but then you can't do the from,size in the ordinary way and you'll have to use the Scroll API.

https://www.elastic.co/guide/en/elasticsearch/reference/6.8/search-request-scroll.html

for example:

 POST /twitter/_search?scroll=1m { "size": 100, "query": {     "match" : {         "title" : "elasticsearch"     } } }