Search rolled-up data

deprecated

POST also GET /{index}/_rollup_search

The rollup search endpoint is needed because, internally, rolled-up documents utilize a different document structure than the original data. It rewrites standard Query DSL into a format that matches the rollup documents then takes the response and rewrites it back to what a client would expect given the original query.

The request body supports a subset of features from the regular search API. The following functionality is not available:

size: Because rollups work on pre-aggregated data, no search hits can be returned and so size must be set to zero or omitted entirely. highlighter, suggestors, post_filter, profile, explain: These are similarly disallowed.

For more detailed examples of using the rollup search API, including querying rolled-up data only or combining rolled-up and live data, refer to the External documentation.

Getting started with rollups

Path Parameters

index union IndexName | [] IndexName required: A comma-separated list of data streams and indices used to limit the request. This parameter has the following rules:

At least one data stream, index, or wildcard expression must be specified. This target can include a rollup or non-rollup index. For data streams, the stream's backing indices can only serve as non-rollup indices. Omitting the parameter or using _all are not permitted.

Multiple non-rollup indices may be specified.

Only one rollup index may be specified. If more than one are supplied, an exception occurs.

Wildcard expressions (*) may be used. If they match more than one rollup index, an exception occurs. However, you can use an expression to match multiple non-rollup indices or data streams.

Search rolled up data stored in sensor_rollup with GET /sensor_rollup/_rollup_search

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /sensor_rollup/_rollup_search
{
  "size": 0,
  "aggregations": {
    "max_temperature": {
      "max": {
        "field": "temperature"
      }
    }
  }
}

JavaScript Elasticsearch JavaScript Client

const response = await client.rollup.rollupSearch({
  index: "sensor_rollup",
  size: 0,
  aggregations: {
    max_temperature: {
      max: {
        field: "temperature",
      },
    },
  },
});

Python Elasticsearch Python Client

resp = client.rollup.rollup_search(
    index="sensor_rollup",
    size=0,
    aggregations={
        "max_temperature": {
            "max": {
                "field": "temperature"
            }
        }
    },
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/sensor_rollup/_rollup_search" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "size": 0,
    "aggregations": {
      "max_temperature": {
        "max": {
          "field": "temperature"
        }
      }
    }
  }'

Java Elasticsearch Java Client

client.rollup().rollupSearch(r -> r
    .aggregations("max_temperature", a -> a
        .max(m -> m
            .field("temperature")
        )
    )
    .index("sensor_rollup")
    .size(0)
);

C# Elasticsearch .NET Client

var response = await client.Rollup
    .RollupSearchAsync<MyDocument>(indices: new[] { "sensor_rollup" }, d1 => d1
        .Aggregations(d2 => d2
            .Add("max_temperature", d3 => d3
                .Max(d4 => d4
                    .Field(x => x.Temperature)
                )
            )
        )
        .Size(0)
    );

PHP Elasticsearch PHP Client

$resp = $client->rollup()->rollupSearch([
    "index" => "sensor_rollup",
    "body" => [
        "size" => 0,
        "aggregations" => [
            "max_temperature" => [
                "max" => [
                    "field" => "temperature",
                ],
            ],
        ],
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.perform_request(
  "GET",
  "/sensor_rollup/_rollup_search",
  {},
  {
    "size": 0,
    "aggregations": {
      "max_temperature": {
        "max": {
          "field": "temperature"
        }
      }
    }
  },
  { "Content-Type": "application/json" },
)

Response

{
  "took" : 102,
  "timed_out" : false,
  "terminated_early" : false,
  "_shards" : {} ,
  "hits" : {
    "total" : {
        "value": 0,
        "relation": "eq"
    },
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "aggregations" : {
    "max_temperature" : {
      "value" : 202.0
    }
  }
}

Path Parameters

Query Parameters { rest_total_hits_as_int , typed_keys , }

Request { aggregations , query , size , }

Response

Query Parameters

Request