@@ -9,33 +9,39 @@ For example, the following search collapses results by `user.id` and sorts them
9
9
by `http.response.bytes`.
10
10
11
11
[source,console]
12
- --------------------------------------------------
13
- GET / my-index-000001/_search
12
+ ----
13
+ GET my-index-000001/_search
14
14
{
15
15
"query": {
16
16
"match": {
17
17
"message": "GET /search"
18
18
}
19
19
},
20
20
"collapse": {
21
- "field": "user.id" <1>
21
+ "field": "user.id" <1>
22
22
},
23
- "sort": [ "http.response.bytes" ], <2>
24
- "from": 10 <3>
23
+ "sort": [
24
+ {
25
+ "http.response.bytes": { <2>
26
+ "order": "desc"
27
+ }
28
+ }
29
+ ],
30
+ "from": 0 <3>
25
31
}
26
- --------------------------------------------------
32
+ ----
27
33
// TEST[setup:my_index]
28
34
29
- <1> Collapse the result set using the " user.id" field
35
+ <1> Collapse the result set using the ` user.id` field
30
36
<2> Sort the results by `http.response.bytes`
31
- <3> define the offset of the first collapsed result
37
+ <3> Define the offset of the first collapsed result
32
38
33
39
WARNING: The total number of hits in the response indicates the number of matching documents without collapsing.
34
40
The total number of distinct group is unknown.
35
41
36
- The field used for collapsing must be a single valued <<keyword, `keyword`>> or <<number, `numeric`>> field with <<doc-values, `doc_values`>> activated
42
+ The field used for collapsing must be a single valued <<keyword, `keyword`>> or <<number, `numeric`>> field with <<doc-values, `doc_values`>> activated.
37
43
38
- NOTE: The collapsing is applied to the top hits only and does not affect aggregations.
44
+ NOTE: Collapsing is applied to the top hits only and does not affect aggregations.
39
45
40
46
[discrete]
41
47
[[expand-collapse-results]]
@@ -44,7 +50,7 @@ NOTE: The collapsing is applied to the top hits only and does not affect aggrega
44
50
It is also possible to expand each collapsed top hits with the `inner_hits` option.
45
51
46
52
[source,console]
47
- --------------------------------------------------
53
+ ----
48
54
GET /my-index-000001/_search
49
55
{
50
56
"query": {
@@ -57,28 +63,34 @@ GET /my-index-000001/_search
57
63
"inner_hits": {
58
64
"name": "most_recent", <2>
59
65
"size": 5, <3>
60
- "sort": [ { "@timestamp": "asc " } ] <4>
66
+ "sort": [ { "@timestamp": "desc " } ] <4>
61
67
},
62
68
"max_concurrent_group_searches": 4 <5>
63
69
},
64
- "sort": [ "http.response.bytes" ]
70
+ "sort": [
71
+ {
72
+ "http.response.bytes": {
73
+ "order": "desc"
74
+ }
75
+ }
76
+ ]
65
77
}
66
- --------------------------------------------------
78
+ ----
67
79
// TEST[setup:my_index]
68
80
69
- <1> collapse the result set using the " user.id" field
70
- <2> the name used for the inner hit section in the response
71
- <3> the number of inner_hits to retrieve per collapse key
72
- <4> how to sort the document inside each group
73
- <5> the number of concurrent requests allowed to retrieve the `inner_hits` per group
81
+ <1> Collapse the result set using the ` user.id` field
82
+ <2> The name used for the inner hit section in the response
83
+ <3> The number of ` inner_hits` to retrieve per collapse key
84
+ <4> How to sort the document inside each group
85
+ <5> The number of concurrent requests allowed to retrieve the `inner_hits` per group
74
86
75
87
See <<inner-hits, inner hits>> for the complete list of supported options and the format of the response.
76
88
77
89
It is also possible to request multiple `inner_hits` for each collapsed hit. This can be useful when you want to get
78
90
multiple representations of the collapsed hits.
79
91
80
92
[source,console]
81
- --------------------------------------------------
93
+ ----
82
94
GET /my-index-000001/_search
83
95
{
84
96
"query": {
@@ -87,51 +99,83 @@ GET /my-index-000001/_search
87
99
}
88
100
},
89
101
"collapse": {
90
- "field": "user.id", <1>
91
- "inner_hits": [
102
+ "field": "user.id", <1>
103
+ "inner_hits": [
92
104
{
93
- "name": "largest_responses", <2>
105
+ "name": "largest_responses", <2>
94
106
"size": 3,
95
- "sort": [ "http.response.bytes" ]
107
+ "sort": [
108
+ {
109
+ "http.response.bytes": {
110
+ "order": "desc"
111
+ }
112
+ }
113
+ ]
96
114
},
97
115
{
98
- "name": "most_recent", <3>
116
+ "name": "most_recent", <3>
99
117
"size": 3,
100
- "sort": [ { "@timestamp": "asc" } ]
118
+ "sort": [
119
+ {
120
+ "@timestamp": {
121
+ "order": "desc"
122
+ }
123
+ }
124
+ ]
101
125
}
102
126
]
103
127
},
104
- "sort": [ "http.response.bytes" ]
128
+ "sort": [
129
+ "http.response.bytes"
130
+ ]
105
131
}
106
- --------------------------------------------------
132
+ ----
107
133
// TEST[setup:my_index]
108
134
109
- <1> collapse the result set using the " user.id" field
110
- <2> return the three largest HTTP responses for the user
111
- <3> return the three most recent HTTP responses for the user
135
+ <1> Collapse the result set using the ` user.id` field
136
+ <2> Return the three largest HTTP responses for the user
137
+ <3> Return the three most recent HTTP responses for the user
112
138
113
139
The expansion of the group is done by sending an additional query for each
114
- `inner_hit` request for each collapsed hit returned in the response. This can significantly slow things down
115
- if you have too many groups and/or `inner_hit` requests.
140
+ `inner_hit` request for each collapsed hit returned in the response. This can
141
+ significantly slow your search if you have too many groups or `inner_hit`
142
+ requests.
116
143
117
144
The `max_concurrent_group_searches` request parameter can be used to control
118
145
the maximum number of concurrent searches allowed in this phase.
119
146
The default is based on the number of data nodes and the default search thread pool size.
120
147
121
- WARNING: `collapse` cannot be used in conjunction with <<scroll-search-results, scroll>>,
122
- <<rescore, rescore>> or <<search-after, search after>> .
148
+ WARNING: `collapse` cannot be used in conjunction with <<scroll-search-results, scroll>> or
149
+ <<rescore, rescore>>.
123
150
124
151
[discrete]
125
152
[[second-level-of-collapsing]]
126
153
=== Second level of collapsing
127
154
128
- Second level of collapsing is also supported and is applied to `inner_hits`.
155
+ A second level of collapsing is also supported and is applied to `inner_hits`.
129
156
130
157
For example, the following search collapses results by `geo.country_name`.
131
158
Within each `geo.country_name`, inner hits are collapsed by `user.id`.
132
159
133
- [source,js]
134
- --------------------------------------------------
160
+ NOTE: Second level of collapsing doesn't allow `inner_hits`.
161
+
162
+ ///////////////
163
+ [source,console]
164
+ ----
165
+ PUT my-index-000001/
166
+ {"mappings":{"properties":{"@timestamp":{"type":"date"},"geo":{"properties":{"country_name":{"type":"keyword"}}},"http":{"properties":{"request":{"properties":{"method":{"type":"keyword"}}}}},"message":{"type":"text","fields":{"keyword":{"type":"keyword"}}},"user":{"properties":{"id":{"type":"keyword","doc_values":true}}}}}}
167
+ ----
168
+
169
+ [source,console]
170
+ ----
171
+ POST my-index-000001/_doc/oX9uXXoB0da05OCR3adK?refresh=true
172
+ {"@timestamp":"2099-11-15T14:12:12","geo":{"country_name":"Amsterdam"},"http":{"request":{"method":"get"},"response":{"bytes":1070000,"status_code":200},"version":"1.1"},"message":"GET /search HTTP/1.1 200 1070000","source":{"ip":"127.0.0.1"},"user":{"id":"kimchy"}}
173
+ ----
174
+ // TEST[continued]
175
+ ///////////////
176
+
177
+ [source,console]
178
+ ----
135
179
GET /my-index-000001/_search
136
180
{
137
181
"query": {
@@ -148,79 +192,97 @@ GET /my-index-000001/_search
148
192
}
149
193
}
150
194
}
151
- --------------------------------------------------
152
- // NOTCONSOLE
195
+ ----
196
+ // TEST[continued]
197
+ // TEST[s/_search/_search\?filter_path=hits.hits/]
153
198
154
-
155
- Response:
156
- [source,js]
157
- --------------------------------------------------
199
+ [source,console-result]
200
+ ----
158
201
{
159
- ...
160
- "hits": [
161
- {
162
- "_index": "my-index-000001",
163
- "_type": "_doc",
164
- "_id": "9",
165
- "_score": ...,
166
- "_source": {...},
167
- "fields": { "geo": { "country_name": [ "UK" ] }},
168
- "inner_hits": {
169
- "by_location": {
170
- "hits": {
171
- ...,
172
- "hits": [
173
- {
174
- ...
175
- "fields": { "user": "id": { [ "user124" ] }}
176
- },
177
- {
178
- ...
179
- "fields": { "user": "id": { [ "user589" ] }}
180
- },
181
- {
182
- ...
183
- "fields": { "user": "id": { [ "user001" ] }}
184
- }
185
- ]
202
+ "hits" : {
203
+ "hits" : [
204
+ {
205
+ "_index" : "my-index-000001",
206
+ "_type" : "_doc",
207
+ "_id" : "oX9uXXoB0da05OCR3adK",
208
+ "_score" : 0.5753642,
209
+ "_source" : {
210
+ "@timestamp" : "2099-11-15T14:12:12",
211
+ "geo" : {
212
+ "country_name" : "Amsterdam"
213
+ },
214
+ "http" : {
215
+ "request" : {
216
+ "method" : "get"
217
+ },
218
+ "response" : {
219
+ "bytes" : 1070000,
220
+ "status_code" : 200
221
+ },
222
+ "version" : "1.1"
223
+ },
224
+ "message" : "GET /search HTTP/1.1 200 1070000",
225
+ "source" : {
226
+ "ip" : "127.0.0.1"
227
+ },
228
+ "user" : {
229
+ "id" : "kimchy"
186
230
}
187
- }
188
- }
189
- },
190
- {
191
- "_index": "my-index-000001",
192
- "_type": "_doc",
193
- "_id": "1",
194
- "_score": ..,
195
- "_source": {...
196
- },
197
- "fields": { "geo": { "country_name": [ "Canada" ] }},
198
- "inner_hits": {
199
- "by_location": {
200
- "hits": {
201
- ...,
202
- "hits": [
203
- {
204
- ...
205
- "fields": { "user": "id": { [ "user444" ] }}
231
+ },
232
+ "fields" : {
233
+ "geo.country_name" : [
234
+ "Amsterdam"
235
+ ]
236
+ },
237
+ "inner_hits" : {
238
+ "by_location" : {
239
+ "hits" : {
240
+ "total" : {
241
+ "value" : 1,
242
+ "relation" : "eq"
206
243
},
207
- {
208
- ...
209
- "fields": { "user": "id": { [ "user1111" ] }
210
- },
211
- {
212
- ...
213
- "fields": { "user": "id": { [ "user999" ] }}
214
- }
215
- ]
244
+ "max_score" : null,
245
+ "hits" : [
246
+ {
247
+ "_index" : "my-index-000001",
248
+ "_type" : "_doc",
249
+ "_id" : "oX9uXXoB0da05OCR3adK",
250
+ "_score" : 0.5753642,
251
+ "_source" : {
252
+ "@timestamp" : "2099-11-15T14:12:12",
253
+ "geo" : {
254
+ "country_name" : "Amsterdam"
255
+ },
256
+ "http" : {
257
+ "request" : {
258
+ "method" : "get"
259
+ },
260
+ "response" : {
261
+ "bytes" : 1070000,
262
+ "status_code" : 200
263
+ },
264
+ "version" : "1.1"
265
+ },
266
+ "message" : "GET /search HTTP/1.1 200 1070000",
267
+ "source" : {
268
+ "ip" : "127.0.0.1"
269
+ },
270
+ "user" : {
271
+ "id" : "kimchy"
272
+ }
273
+ },
274
+ "fields" : {
275
+ "user.id" : [
276
+ "kimchy"
277
+ ]
278
+ }
279
+ }
280
+ ]
281
+ }
216
282
}
217
283
}
218
284
}
219
- },
220
- ...
221
- ]
285
+ ]
286
+ }
222
287
}
223
- --------------------------------------------------
224
- // NOTCONSOLE
225
-
226
- NOTE: Second level of collapsing doesn't allow `inner_hits`.
288
+ ----
0 commit comments