# Elasticsearch input plugin size **URL:** \ **Category:** Logstash\ **Created:** [August 1, 2021, 7:23pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163 "2021-08-01T19:23:57Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![JFO\_90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfo_90/32/83901_2.png) [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Post date:** [August 1, 2021, 7:23pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/1 "2021-08-01T19:23:57Z")
Hi, I have a logstash configuration from which I'm trying to extract elasticsearch information with the elasticsearch input plugin. The problem that i have is that despite indicating a size, it always returns all the documents from the index has instead of the amount indicated in the index. input { elasticsearch { hosts =\> ["localhost:9200"] index =\> "myindex" query =\> '{ "query": {"match\_all": {}} }' size =\> 100 docinfo =\> true } } In the configuration you can see how I indicate a size of 100 but ignore this value and return all the documents of the index. Can someone help me with this problem? Best regards ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2021, 7:57pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/2 "2021-08-01T19:57:34Z")
I think the size option only takes effect if scroll is enabled. In which case the input will repeatedly make calls to the search API until all of the documents that match the query are returned. If you want to limit the number of documents returned by the query you need to tell elasticsearch that. I think that would be ``` query => '{ "query": {"match_all": {}}, "size": 100 }' ``` ---
**Author:** ![JFO\_90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfo_90/32/83901_2.png) [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Post date:** [August 1, 2021, 8:29pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/3 "2021-08-01T20:29:22Z")
I have tried with the scroll field and with the size in the query and it keeps returning all the docs. input { elasticsearch { hosts =\> "localhost:9200" index =\> "myindex" query =\> '{ "query": {"match\_all": {}}, "size": 100 }' docinfo =\> true } } input { elasticsearch { hosts =\> ["localhost:9200"] index =\> "myindex" query =\> '{ "query": {"match\_all": {}} }' size =\> 100 scroll =\> "5m" docinfo =\> true } } Both return all the docs of the index. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2021, 9:59pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/4 "2021-08-01T21:59:53Z")
The second one is expected to return all documents. The input will loop fetching 100 documents at a time until it has gotten them all. I think I had size in the wrong place. Try ``` query => '{ "query": {"match_all": {}, "size": 100}}' ``` ---
**Author:** ![JFO\_90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfo_90/32/83901_2.png) [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Post date:** [August 1, 2021, 10:43pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/5 "2021-08-01T22:43:55Z")
Y tried elasticsearch { hosts =\> "localhost:9200" index =\> "myindex" query =\> '{ "query": {"match\_all": {}, "size": 100}}' docinfo =\> true } And the result was E Error: [400] {"error":{"root\_cause":[{"type":"parsing\_exception","reason":"[match\_all] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]","line":1,"col":26}],"type":"parsing\_exception","reason":"[match\_all] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]","line":1,"col":26},"status":400} ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 1, 2021, 11:09pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/6 "2021-08-01T23:09:53Z")
Looking at an example from the input documentation ``` query => '{ "query": { "match": { "statuscode": 200 } }, "sort": ["_doc"] }' ``` "sort" is at the same level as "query" so I had it right the first time. I don't know DSL well enough to know if size can be used in the same way. I guess not. ---
**Author:** ![JFO\_90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfo_90/32/83901_2.png) [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Post date:** [August 1, 2021, 11:23pm UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/7 "2021-08-01T23:23:12Z")
I was trying with different queries like this query =\> '{ "query": { "bool": { "filter": [ { "terms": { "enviroment": [ "pre" ] } } ] } }, "size": 100 }' This DSL query return results, but not 100 as i said on the size, this query return more than 100 results. It seems that the size field does not work as indicated in the beginning of the topic ---
**Author:** ![JFO\_90](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jfo_90/32/83901_2.png) [@JFO\_90](https://discuss.elastic.co/u/JFO_90)\ **Post date:** [August 3, 2021, 11:15am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/8 "2021-08-03T11:15:25Z")
Has anyone encountered this problem or knows how to solve it? Best regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2021, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-input-plugin-size/280163/9 "2021-08-31T11:16:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.