13

It may be a beginner question, but I have some doubts related to size. As per elastic search specs, the maximum value of size can be 10000, I want to validate my understandings below:

Sample Query:

GET testindex-2016.04.14/_search
{
  "size": 10000,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "type": "TEST"
          }
        }
      ]
    }
  }, 
  "aggs": {
    "testAggs": {
      "terms": {
        "field": "type",
        "size": 0
      },
      "aggs": {
        "innerAggs": {
          "max": {
            "field": "Value"
          }
        }
      }
    }
  }
}

Response:

{
  "took": 6,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 26949,
    "max_score": 0,
    "hits": [
       .....10000 records   
     ]
  },
  "aggregations": {
    "test": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "TEST",
          "doc_count": 26949,
          "innerAggs": {
            "value": 150
          }
        }
      ]
    }
  }
}

1 - If size is set to 10000, and we have more than 200000 records in elastic search satisfying the query, So in query result, I will get the no. of hits to 10000, but the "total" : 200000.

2 - How many records will be available for further aggregations - the no. of hits or the "total" value.

3 - If we set "size" : 0, in this case, we get hits = 0, but how many records will be available for aggregations ?

Please clarify my understanding, and put comments in any doubt in question . Thanks.

pbajpai
  • 1,303
  • 1
  • 9
  • 24

1 Answers1

17

  1. The size parameter only tells how many hits should be returned in the response, so if you specify size: 10000 and 200000 records match, you'll get 10000 matching documents in the result hits, but total will state 200000

  2. aggregations are always computed on the full set of results, so the total value.

  3. See 2

Val
  • 207,596
  • 13
  • 358
  • 360
  • Thanks for your answer, I knew that I will get answer from you, So I have one more doubt- Is there any upper limit on the "total" value, I mean the query and aggregations run on all the matching records, regardless of the number. – pbajpai Mar 29 '17 at 06:03
  • 1
    No upper limit except a physical one, which is the number of total documents that a shard can contain (=Integer.MAX_VALUE). – Val Mar 29 '17 at 06:05