I have a logstash configuration from which I'm trying to extract elasticsearch information with the elasticsearch input plugin. The problem that i have is that despite indicating a size, it always returns all the documents from the index has instead of the amount indicated in the index.
I think the size option only takes effect if scroll is enabled. In which case the input will repeatedly make calls to the search API until all of the documents that match the query are returned.
If you want to limit the number of documents returned by the query you need to tell elasticsearch that. I think that would be
E Error: [400] {"error":{"root_cause":[{"type":"parsing_exception","reason":"[match_all] malformed query, expected [END_OBJECT] but found [FIELD_NAME]","line":1,"col":26}],"type":"parsing_exception","reason":"[match_all] malformed query, expected [END_OBJECT] but found [FIELD_NAME]","line":1,"col":26},"status":400}
"sort" is at the same level as "query" so I had it right the first time. I don't know DSL well enough to know if size can be used in the same way. I guess not.
This DSL query return results, but not 100 as i said on the size, this query return more than 100 results.
It seems that the size field does not work as indicated in the beginning of the topic
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.