Get the hit count in EQL

[sanju1323 (Sanjay Reddy)]

Hi,

I'm using the EQL queries for my search and want to get the hits.total.value .
When I try the below query, i'm getting the hits.total.value as 10. But I'm not getting the total count of the hits for the search.

GET logstash-test/_eql/search
{
"query": "any where isalarm =="1""
}

Can someone please help me in getting hit count for the query. (Like I have 167543 hits matching for the above query. I have tried using fetch_size as well but that is not giving me the total count of 167543)

[Priscilla_Parodi]

Hello @sanju1323,

By default, the size parameter is set to 10, which determines the maximum number of matching events that will be returned. Have you tried setting a higher value for the size parameter to get more hits?

GET logstash-test/_eql/search
{
   "query": "...",
   "size": ...
}

[sanju1323 (Sanjay Reddy)]

Hi @Priscilla_Parodi,

Thanks for the update.
I have tried giving "size" as higher number. But we need the count of all the matching results.
Which means, if I have 20,000 hits, I want all the hits.

Please suggest.

Thanks