# How to print more than 10 (default) output in chain query

**URL:** https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 18, 2018, 4:08pm UTC](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338 "2018-06-18T16:08:20Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 18, 2018, 4:08pm UTC](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338/1 "2018-06-18T16:08:21Z")

</div>

I am not able to print more than 10 (which i think is default) output using below query

```
{
      "trigger": {
        "schedule": {
          "interval": "10s"
        }
      },
      "input": {
        "chain": {
          "inputs": [
            {
              "first": {
                "search": {
                  "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                      "logstash-security-*"
                    ],
                    "types": [],
                    "body": {
                      "aggs": {
                        "indicator": {
                          "terms": {
                            "field": "indicator.keyword",
                            "order": {
                              "_count": "desc"
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            },
            {
              "second": {
                "search": {
                  "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                      "logstash-checkpoint-*"
                    ],
                    "types": [],
                    "body": {
                      "query": {
                        "bool": {
                          "must": [
                            {
                              "query_string": {
                                "query": "dstip:{{#ctx.payload.first.aggregations.indicator.buckets}}{{key}} {{/ctx.payload.first.aggregations.indicator.buckets}}"
                              }
                            },
                            {
                              "range": {
                                "@timestamp": {
                                  "gte": "now-7d"
                                }
                              }
                            }
                          ]
                        }
                      }
                    }
                  }
                }
              }
            }
          ]
        }
      },
      "condition": {
        "compare": {
          "ctx.payload.second.hits.total": {
            "gt": 0
          }
        }
      },
      "actions": {
        "log": {
          "logging": {
            "level": "info",
            "text": "Test"
          }
        },
        "send_mail": {
          "email": {
            "profile": "standard",
            "to": [
              "addanuj@gmail.com"
            ],
            "subject": "DEVTools test Internal connections to known malware IPs",
            "body": {
              "html": "<table border='2'><tr><th>ThreatIntel IP</th><th>count</th></tr><tr>{{#ctx.payload.first.aggregations.indicator.buckets}}<td>{{key}}</td><td>{{doc_count}}</td></tr><tr>{{/ctx.payload.first.aggregations.indicator.buckets}}</tr></table>"
            }
          }
        }
      }
    }
```

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 22, 2018, 2:06pm UTC](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338/2 "2018-06-22T14:06:32Z")

</div>

Check the [size](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/search-request-from-size.html) parameter of the search query.

--Alex

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 20, 2018, 2:06pm UTC](https://discuss.elastic.co/t/how-to-print-more-than-10-default-output-in-chain-query/136338/3 "2018-07-20T14:06:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.