Running template query with extra parameters

Elastic Stack Elasticsearch
1

I have file based pre-registered search template test.mustache with following query in it

{
   "query":{
      "range":{
         "@timestamp":{
            "lte":"{{end_time}}",
            "gte":"{{start_time}}"
         }
      }
   },
   "from":0,
   "size":1
}

Now I try run this template in template query style with following payload

{
    "query": {
        "template": {
            "file": "test", 
            "params" : {
                "end_time" : "now",
                "start_time" : "now-800h"
            }
        }
    }
}

Even with the following payload I see 10 entries instead of 1 (since I mentioned the size as 1 in search template) . What I noticed in general that template query does not care about any other parameter (like size, from, aggs, etc. ) apart from query. Do I need to follow some other syntax to accommodate that change?

Thanks,
Siddharth

2

I think your syntax is a bit off? Searching with re-registered templates don't use the "template" parameter in the body. I think it should be something closer to:

GET /_search/template
{
    "file": "test", 
    "params": {
        "end_tyime": "now",
        "start_time" : "now-800h"
    }
}
3

Thanks @polyfractal . I see your point. I do not know if I am getting things wrong or what, but do you find that the following two documents give two different ways to do the same thing but have inconsistent results ?

Both explain how to run a pre-registered template query but just have different syntax, in my opinion.

4

Ahh, I see. Yes, that is a bit confusing (took me a few minutes to ponder it out myself).

So in the first case, that's a "template query". E.g. it's a query that uses a template. So the contents of the template can only affect the actual query that's being run, not any of the other portions of the search request (like the size, aggregations, highlighting, etc).

The second case is a "template search", which means the template can cover the entire search request. This includes from/to parameters, aggregations, sorting, etc.

That's why the syntax is slightly different, and also why your template query was unable to affect the size.

At least, I think that's the reason :slight_smile: I've not used template queries much, so I may be mistaken. Lemme know if that works for you, if not I can dig into it a bit more!

5

Thanks a lot @polyfractal . That helped and cleared my doubt :slight_smile: Now I see what I need to use for what.