# Top\_hits return multiple values whenever I declared the size = 1

**URL:** <https://discuss.elastic.co/t/top-hits-return-multiple-values-whenever-i-declared-the-size-1/191145>\
**Category:** Elasticsearch\
**Created:** [July 18, 2019, 7:52am UTC](https://discuss.elastic.co/t/top-hits-return-multiple-values-whenever-i-declared-the-size-1/191145 "2019-07-18T07:52:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![niraj\_pandey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/niraj_pandey/32/44034_2.png) [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\
**Post date:** [July 18, 2019, 7:52am UTC](https://discuss.elastic.co/t/top-hits-return-multiple-values-whenever-i-declared-the-size-1/191145/1 "2019-07-18T07:52:20Z")

</div>

Hi ,

I am using an ealstic query where I need to find all the running job in last 15 mins.  
I captured the job data in a index. I just want to get the latest doc (single doc for each job). I tried to use top\_hits but I am getting multiple value for a jobid. Could you pls help me.  
Here is my query.

es.search(index='xyz-\*',size=10000, body ={"aggs": { "group": { "terms": { "field": "Id.keyword" }, "aggs": { "group\_docs": { "top\_hits": { "size": 1, "sort": [{ "@timestamp": { "order": "desc" } }] } } } } }, "query": { "bool": { "must": [{ "match\_all": {} }, { "match\_phrase": { "clustername": { "query": "abc" } } }, { "match\_phrase": { "status.keyword": { "query": "RUNNING" } } },{ "range": { "@timestamp": { "gte": 1563428965639, "lte": 1563429865639, "format": "epoch\_millis" } } }] }} })

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [July 19, 2019, 12:49pm UTC](https://discuss.elastic.co/t/top-hits-return-multiple-values-whenever-i-declared-the-size-1/191145/2 "2019-07-19T12:49:57Z")

</div>

> [@niraj\_pandey](#):
>
> I am getting multiple value for a jobid

That shouldn't happen with top\_hits and `size:1`.  
Can you share an example mapping, docs, search and result (with formatted JSON so it's readable).

In practice it may not give you what you're looking for anyway - presumably your query is filtering log records where status is "running" - you won't see the logged event docs where the same job has status "stopped" so you may be assuming a job is still running when it's not?

In these sorts of cases it can be simpler to update a single doc with the ID of the job and update the `lastStatus` and `lastTime` fields then do your aggregations based on that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2019, 12:50pm UTC](https://discuss.elastic.co/t/top-hits-return-multiple-values-whenever-i-declared-the-size-1/191145/3 "2019-08-16T12:50:01Z")

</div>

Closed on August 16, 2019, 12:50pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.