What is the meaning of "hits.total" in an aggregate search query?

Elastic Stack Elasticsearch
1

I found this Is hits.total limited by max_results_window? - #3 which says hits shouldnt be limited

However, I have the following query

# POST /assets/_search
{
  "size": 0,
  "query": {
    "bool": {
        "must": [
            {
                "range": {
                    "@timestamp": {
                        "gte": "2021-05-01T00:00:00.000",
                        "lt": "2021-06-01T00:00:00.000"
                    }
                }
            }
        ]
    }
  },

  "aggs": {
    "by_company": {
      "terms": {
        "field": "company.keyword"
      },
      "aggs": {
        "total_bytes": {
          "sum": {
            "field": "sc_bytes"
          }
        }
      }
    }
  }
}

which returns

{
    "took": 363,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 10000,
            "relation": "gte"
        },
        "max_score": null,
        "hits": []
    },
    "aggregations": {
        "by_company": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 226540,
            "buckets": [
                {
                    "key": "company-A",
                    "doc_count": 1250879,
                    "total_bytes": {
                        "value": 8.2237361295E10
                    }
                },
                {
                    "key": "company-B",
                    "doc_count": 599260,
                    "total_bytes": {
                        "value": 7.1886573655E10
                    }
                },
                {
                    "key": "company-C",
                    "doc_count": 543490,
                    "total_bytes": {
                        "value": 8.2209572727E10
                    }
                },
                {
                    "key": "company-D",
                    "doc_count": 381340,
                    "total_bytes": {
                        "value": 2.13924845301E11
                    }
                },
                {
                    "key": "company-E",
                    "doc_count": 250958,
                    "total_bytes": {
                        "value": 4.2741116225E10
                    }
                },
                {
                    "key": "company-F",
                    "doc_count": 125527,
                    "total_bytes": {
                        "value": 1.1325787695E10
                    }
                },
                {
                    "key": "company-G",
                    "doc_count": 105573,
                    "total_bytes": {
                        "value": 7.014646072E9
                    }
                },
                {
                    "key": "company-H",
                    "doc_count": 91052,
                    "total_bytes": {
                        "value": 6.961368426E9
                    }
                },
                {
                    "key": "company-I",
                    "doc_count": 82524,
                    "total_bytes": {
                        "value": 1.0034492093E10
                    }
                },
                {
                    "key": "company-J",
                    "doc_count": 53561,
                    "total_bytes": {
                        "value": 3.339075245E9
                    }
                }
            ]
        }
    }
}

What is the meaning of the value 10,000 for hits? No matter the date range its always 10,000 unless I restrict the dates very small, then the hits number goes lower

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.