I'm on es 2.3 (Amazon es), and I'm trying to grab the latest document that was put in indices of a specific format. However, the search result seems to be ignoring the "order" parameter in sort.
I'm creating the index with:
PUT /index_prefix-date -d
' {
"mappings": {
"_default_": {
"properties": {
"event_time": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ssZ"
}
}
}
}
}'
The events are put in via bulk api, and all documents have a corresponding event_time field. When the logs are viewed on Kibana, they are correctly sorted by event_time field in descending order.
However, when I do this:
GET /index_prefix-*/_search -d
'{
"query": {
"match_all": {}
},
"sort": [
{
"event_time": {
"order": "desc"
}
}
],
"size": 1
}'
I get the earliest document in those indices, rather than the latest. I've tried changing the order parameter to "asc" but that still returns the earliest document. Changing the size does not help, as it still returns the earliest n documents sorted from earliest to latest.
Is there something wrong with my search query?
edit* Upon further investigation, it seems that the issue occurs specifically when putting the sort parameters in the body.
If I specify the sort parameter in the url, aka
GET /index_prefix-*/_search?sort=event_time:desc -d
'{
"query": {
"match_all": {}
},
"size": 1
}'
I get the correct result of the latest document.