Search_after doesn't consider the parameter

Elastic Stack Elasticsearch
1

Hello, this is my first topic ever.
When I run this query it returns 10 documents,(10 is the default number)

resp = elastic_config.open_point_in_time(index='my_index', keep_alive='1m')
            pit_clause = { 'id': resp['id'], 'keep_alive': '1m'}
            result = elastic_config.search(
                query = {
                    "bool" : {
                        "filter": [
                            {
                                "term" : {
                                    "my_term.keyword": "my_parameter",
                                }},
                            {
                                "term" : {
                                    "my_another_term.keyword": "my_another_parameter",
                                }},
                        ],
                        },
                    },
                    pit = pit_clause,
                    search_after = [1716803519],
                    sort={
                            "@timestamp" : {
                                "order" : "asc"
                            }
                        },request_timeout= 100)

and when I run this, it returns 5000 documnts.

resp = elastic_config.open_point_in_time(index='my_index', keep_alive='1m')
            pit_clause = { 'id': resp['id'], 'keep_alive': '1m'}
            result = elastic_config.search(size=5000,
                query = {
                    "bool" : {
                        "filter": [
                            {
                                "term" : {
                                    "my_term.keyword": "my_parameter",
                                }},
                            {
                                "term" : {
                                    "my_another_term.keyword": "my_another_parameter",
                                }},
                        ],
                        },
                    },
                    pit = pit_clause,
                    search_after = [1716803519],
                    sort={
                            "@timestamp" : {
                                "order" : "asc"
                            }
                        },request_timeout= 100)

In fact it doesn't consider the value I'm passing to "search_after", it just returns documents as many as the size number.
what's wrong?I want to get documents after the specified time
version: 7.16.2

2

It seems that we have understood the search_after definition wrong.
as the document said, it is used to require us with paginated results, and the size field is actually the page size.

above, you have run queries with same search_after parameters and different size, which works properly in both cases.

look at search_after somehow as a filter, to filter documents having greater than provided value in their specified field (here timestamp)

3

Thank you but no it doesn't filter the results based on timestamp here.
It even returns records earlier than the given value for search_after.
It only returns last records as many as the size value

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.