Search after with a PIT

search_after_with_pit.md

# Creat a PIT (Point in Time)
POST /auditbeat-8.0.0/_pit?keep_alive=10m

# First page of 2 items (no "search_after" specified)
GET /_search
{
  "size": 2, 
  "pit": {
    "id": "46ToAwEhYXVkaXRiZWF0LTguMC4wLTIwMjIuMDIuMTQtMDAwMDAxFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAFk0tblloZ2RYUjVDWUJLQUhYUHNmdHcAAAAAAAAEnSMWR0NfVWdlakZSSEszcGVzbXpfSTdoZwABFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAAA==",
    "keep_alive": "10m"
  },
  "sort": [
    {
      "_shard_doc": "desc"
    }
  ]
}

# Second page by taking the returned sort from the first query above ("search_after" specified).
GET /_search
{
  "size": 2,
  "pit": {
    "id": "46ToAwEhYXVkaXRiZWF0LTguMC4wLTIwMjIuMDIuMTQtMDAwMDAxFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAFk0tblloZ2RYUjVDWUJLQUhYUHNmdHcAAAAAAAAEnSMWR0NfVWdlakZSSEszcGVzbXpfSTdoZwABFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAAA==",
    "keep_alive": "10m"
  },
  "sort": [
    {
      "_shard_doc": "desc"
    }
  ],
  "search_after": [175296]
}