Elasticsearch API request

Elastic Stack Elasticsearch
1

GET /lb-2026.04/_search
{
"size": 10000,
"aggs": {
"last_entry": {
"max": {
"field": "@timestamp"
}
}
}
}

I want to retrieve all latest timestamp documents from Index lb-2026.04 but number of documents are exceeding from 10K they are approximately 15K. Is there a way to achieve this in a single request??

2

(post deleted by author)

3

Welcome to the forum @Cdotisp_Delhi !!

I replied too quickly, not reading the question carefully. Sorry for this.

Your question's wording is slightly ambiguous:

Are you saying you have maybe 15K documents all with the same "max" value of @timestamp from the index? That wasn't my first reading, seems unlikely, but maybe that is what you want?

And please note the size parameter is not relevant to the max aggregation you included, the max aggregation is applied to all matching documents anyways, in your case all documents in the index.

If you want just more results returned, the simplest way is to use index.max_result_window, increasing from default 10,000.

PUT lb-2026.04/_settings
{
"index.max_result_window": 20000
}

then you can query that index with size parameter up to 20000. But the default is 10K for a reason, please don't increase too much without some thought.

So also ask yourself if you really need all the results in one request? What if result set is not 15K, rather 150K or 1.5M results?

The official docs suggest the more correct solution would be to use scroll or search_after, and get all docs in chunks. But if you just want a quick fix for today, increasing index.max_result_window is IMO easiest.

4

Thanks a lot Kevin, it worked, Kudos to you!!! Humans are more dependable than AI.

1 Like
5

Hey

Glad you solved it but I'm reading again your question and I wanted to ask what do you mean by

I want to retrieve all latest timestamp documents from Index lb-2026.04

Do you want to get the last 10 documents for example?

In which case, you just need to use sort:

GET /lb-2026.04/_search
{
  "sort" : [
    { "@timestamp" : {"order" : "desc"}
  ]
}

You can also get more documents with:

GET /lb-2026.04/_search
{
  "size": 100,
  "sort" : [
    { "@timestamp" : {"order" : "desc"}
  ]
}

Would that solve the question?

TBH: I don't like much modifying the index.max_result_window as it has consequences:

The maximum value of from + size for searches to this index. Defaults to 10000 . Search requests take heap memory and time proportional to from + size and this limits that memory. See Scroll or Search After for a more efficient alternative to raising this.

1 Like