Getting on the "total" of a term

Hi,

When I type in:

GET filebeat-*/log/_search
{
  "query": {

        "term" : {"terminationCause": "SUCCESS"}
    }
  }

I get:

{
  "took": 25,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 96,
    "max_score": 3.1475947,
    "hits": [
      {
        "_index": "filebeat-2017.03.19",

etc,

Now I want only to get the "total" field only to get the number 96.

I will be happy for any help :grinning:

Hello, exist different json parsers, one of them: https://stedolan.github.io/jq/
jq '.hits' find necesary json param, then with grep and tr we will take total result:

curl -s localhost:9200/twitte/_search?q=: | jq '.hits' |grep total |tr -cd '[[:digit:]]'

i don't sure that this method is optimized, so you should found another solution.
But this - return correct result.

1 Like

Set size: 0 to reduce the returned JSON.

There is also https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#common-options-response-filtering

1 Like

Thanks for the reply,

I tried your solution and I got:

I dont really understand this result.

Add -s param to curl , and try to use without pretty

1 Like

Tomer you should use this solution:

curl -s localhost:9200/twitte/_search?filter_path=hits.total | tr -cd '[[:digit:]]'

Yes,

It did work with jq

Add size=0 to have better response time

1 Like

Thx, it does take sometime, where should I add this?

curl -s "localhost:9200/twitter/_search?filter_path=hits.total&size=0" | tr -cd '[[:digit:]]'
2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.