# Elasticsearch not returning larger results (not total result size/length, but size of individual hit

**URL:** <https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242>\
**Category:** Elasticsearch\
**Created:** [November 17, 2022, 9:23pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242 "2022-11-17T21:23:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![NickIsWorking](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\
**Post date:** [November 17, 2022, 9:23pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/1 "2022-11-17T21:23:45Z")

</div>

Hello. I have an Elasticsearch instance, storing objects that contain really large strings. I am trying to make a request to retrieve those objects from elasticsearch, but for whatever reason, elasticsearch will not return them.

Example Object In elasticsearch:

```auto
{
   "time": "2022-11-17T15:36:34.000Z",
   "status": "ok",
   "data": "00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00"
}

```

The data property is a really long string, a lot longer then the example, the string can be as long as 5000 characters.

I attempt to retrieve those objects using a curl request to elasticsearch, like the example below:

```auto
curl http://es-instance:9200/myIndexPattern_*/_search?size=10000 -H "Content-Type: application/json" -d '{"size":10000,"query":{"bool":{"must":[{"range":{"time":{"from":"2022-11-17T14:35:32.000Z","to":"2022-11-17T15:35:39.000Z"}}}]}}}'

```

This results in 0 hits but I do know that there is data available at that time by looking through the kibana UI.

The actual response from the curl request is as follows:

```auto
{"took":0,"timed_out":false,"_shards":{"total":0,"successful":0,"skipped":0,"failed":0},"hits":{"total":{"value":0,"relation":"eq"},"max_score":0.0,"hits":[]}}

```

Upon further investigation I found that if the 'data' property in my stored object was smaller in size, then elasticsearch wouldn't have a problem returning those objects from my request.

My question is, is there some max size that an object in elasticsearch can be for it to return it when requested? Or is there some setting I can add to my request to retrieve these larger objects?

To make myself clear this is not a question of max amount of returned objects, but of max size of a single returned object.

Thank you.

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood1/32/101255_2.png) [@Mark\_Harwood1](https://discuss.elastic.co/u/Mark_Harwood1)\
**Post date:** [November 18, 2022, 8:46am UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/2 "2022-11-18T08:46:15Z")

</div>

> [@NickIsWorking](#):
>
> My question is, is there some max size that an object in elasticsearch can be for it to return it when requested?

The default keyword mapping ignores strings longer than 256 characters, [silently dropping values from the list of indexed terms](https://discuss.elastic.co/t/i-need-help-elasticsearch-does-not-match-my-regexp-wildcard-or-query-string-queries/239473).

Note that if you _do_ [raise](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/ignore-above.html) the Elasticsearch limit, you cannot exceed the hard Lucene limit of 32k for a single token

If you’re searching for exact large values (as opposed to parts of large values) then it may be more efficient to index hashes of the content and deal with the rare issue of false positives in your client.

---

<div class="post-metadata">

**Author:** ![NickIsWorking](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\
**Post date:** [November 22, 2022, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/3 "2022-11-22T15:52:54Z")

</div>

I don't think i understand your response. Isn't the keyword mapping/ignore\_above value used for indexing values. I don't have a problem getting my objects indexed into elasticsearch. I can see them in es using Kibana. My problem is retrieving those already indexed values from elasticsearch externally from the ELK stack.

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood1/32/101255_2.png) [@Mark\_Harwood1](https://discuss.elastic.co/u/Mark_Harwood1)\
**Post date:** [November 22, 2022, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/4 "2022-11-22T16:54:21Z")

</div>

My bad. I’d assumed you were querying using that long data value - that would have been the only explanation I’d have expected for a field’s size dictating if something is returned or not.

The results have the ‘failed’ and ‘skipped’ properties == 0 so all shards have been queried successfully. Can you share the mappings, missing docs and example query?

---

<div class="post-metadata">

**Author:** ![NickIsWorking](https://avatars.discourse-cdn.com/v4/letter/n/278dde/32.png) [@NickIsWorking](https://discuss.elastic.co/u/NickIsWorking)\
**Post date:** [November 22, 2022, 9:02pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/5 "2022-11-22T21:02:57Z")

</div>

After looking into it a bit more. Turns about this was all just a big dumb mistake on my part. There doesn't appear to anything stopping me from querying large sized objects. I don't seem to having this problem anymore.... Why I believe I was having the problem earlier was, in short, due to a timing issue. I was expecting the data that I was querying to be in a certain time range, but because of something stupid i was doing with my code, it was actually being archived in a different time range.

Thank you @Mark_Harwood1 for your quick replies in trying to help me solve my problem.

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood1/32/101255_2.png) [@Mark\_Harwood1](https://discuss.elastic.co/u/Mark_Harwood1)\
**Post date:** [November 22, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/6 "2022-11-22T22:59:25Z")

</div>

> [@NickIsWorking](#):
>
> this was all just a big dumb mistake on my part.

Some bugs are just waiting for a bigger audience 😀  
Glad to hear you sorted it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2022, 10:59pm UTC](https://discuss.elastic.co/t/elasticsearch-not-returning-larger-results-not-total-result-size-length-but-size-of-individual-hit/319242/7 "2022-12-20T22:59:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.