All methods and paths for this operation:
The rollup search endpoint is needed because, internally, rolled-up documents utilize a different document structure than the original data. It rewrites standard Query DSL into a format that matches the rollup documents then takes the response and rewrites it back to what a client would expect given the original query.
The request body supports a subset of features from the regular search API. The following functionality is not available:
size: Because rollups work on pre-aggregated data, no search hits can be returned and so size must be set to zero or omitted entirely.
highlighter, suggestors, post_filter, profile, explain: These are similarly disallowed.
Searching both historical rollup and non-rollup data
The rollup search API has the capability to search across both "live" non-rollup data and the aggregated rollup data. This is done by simply adding the live indices to the URI. For example:
GET sensor-1,sensor_rollup/_rollup_search
{
"size": 0,
"aggregations": {
"max_temperature": {
"max": {
"field": "temperature"
}
}
}
}
The rollup search endpoint does two things when the search runs:
When the two responses are received, the endpoint rewrites the rollup response and merges the two together. During the merging process, if there is any overlap in buckets between the two responses, the buckets from the non-rollup index are used.
A comma-separated list of data streams and indices used to limit the request. This parameter has the following rules:
_all are not permitted.*) may be used. If they match more than one rollup index, an exception occurs. However, you can use an expression to match multiple non-rollup indices or data streams.Indicates whether hits.total should be rendered as an integer or an object in the rest search response
Specify whether aggregation and suggester names should be prefixed by their respective types in the response
Specifies aggregations.
Specifies a DSL query that is subject to some limitations.
Must be zero if set, as rollups work on pre-aggregated data.
GET /sensor_rollup/_rollup_search
{
"size": 0,
"aggregations": {
"max_temperature": {
"max": {
"field": "temperature"
}
}
}
}resp = client.rollup.rollup_search(
index="sensor_rollup",
size=0,
aggregations={
"max_temperature": {
"max": {
"field": "temperature"
}
}
},
)const response = await client.rollup.rollupSearch({
index: "sensor_rollup",
size: 0,
aggregations: {
max_temperature: {
max: {
field: "temperature",
},
},
},
});response = client.rollup.rollup_search(
index: "sensor_rollup",
body: {
"size": 0,
"aggregations": {
"max_temperature": {
"max": {
"field": "temperature"
}
}
}
}
)$resp = $client->rollup()->rollupSearch([
"index" => "sensor_rollup",
"body" => [
"size" => 0,
"aggregations" => [
"max_temperature" => [
"max" => [
"field" => "temperature",
],
],
],
],
]);curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"size":0,"aggregations":{"max_temperature":{"max":{"field":"temperature"}}}}' "$ELASTICSEARCH_URL/sensor_rollup/_rollup_search"client.rollup().rollupSearch(r -> r
.aggregations("max_temperature", a -> a
.max(m -> m
.field("temperature")
)
)
.index("sensor_rollup")
.size(0)
);
{
"size": 0,
"aggregations": {
"max_temperature": {
"max": {
"field": "temperature"
}
}
}
}{
"took" : 102,
"timed_out" : false,
"terminated_early" : false,
"_shards" : {} ,
"hits" : {
"total" : {
"value": 0,
"relation": "eq"
},
"max_score" : 0.0,
"hits" : [ ]
},
"aggregations" : {
"max_temperature" : {
"value" : 202.0
}
}
}