Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@FrankHassanabad
Last active March 4, 2024 18:40
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save FrankHassanabad/c5958f38fe6a8f92cd8c64b104e44376 to your computer and use it in GitHub Desktop.
Save FrankHassanabad/c5958f38fe6a8f92cd8c64b104e44376 to your computer and use it in GitHub Desktop.
Search after with a PIT
# Creat a PIT (Point in Time)
POST /auditbeat-8.0.0/_pit?keep_alive=10m

# First page of 2 items (no "search_after" specified)
GET /_search
{
  "size": 2, 
  "pit": {
    "id": "46ToAwEhYXVkaXRiZWF0LTguMC4wLTIwMjIuMDIuMTQtMDAwMDAxFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAFk0tblloZ2RYUjVDWUJLQUhYUHNmdHcAAAAAAAAEnSMWR0NfVWdlakZSSEszcGVzbXpfSTdoZwABFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAAA==",
    "keep_alive": "10m"
  },
  "sort": [
    {
      "_shard_doc": "desc"
    }
  ]
}

# Second page by taking the returned sort from the first query above ("search_after" specified).
GET /_search
{
  "size": 2,
  "pit": {
    "id": "46ToAwEhYXVkaXRiZWF0LTguMC4wLTIwMjIuMDIuMTQtMDAwMDAxFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAFk0tblloZ2RYUjVDWUJLQUhYUHNmdHcAAAAAAAAEnSMWR0NfVWdlakZSSEszcGVzbXpfSTdoZwABFmI2ZEk1NnMtUlZxM25hY3ZkeUVnN2cAAA==",
    "keep_alive": "10m"
  },
  "sort": [
    {
      "_shard_doc": "desc"
    }
  ],
  "search_after": [175296]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment