Search rolled-up data

  • POST also GET /{index}/_rollup_search
Auth Deprecated

The rollup search endpoint is needed because, internally, rolled-up documents utilize a different document structure than the original data. It rewrites standard Query DSL into a format that matches the rollup documents then takes the response and rewrites it back to what a client would expect given the original query.

The request body supports a subset of features from the regular search API. The following functionality is not available:

size: Because rollups work on pre-aggregated data, no search hits can be returned and so size must be set to zero or omitted entirely. highlighter, suggestors, post_filter, profile, explain: These are similarly disallowed.

For more detailed examples of using the rollup search API, including querying rolled-up data only or combining rolled-up and live data, refer to the External documentation.

Getting started with rollups

Path parameters

index union string | string[] required

A comma-separated list of data streams and indices used to limit the request. This parameter has the following rules:

  • At least one data stream, index, or wildcard expression must be specified. This target can include a rollup or non-rollup index. For data streams, the stream's backing indices can only serve as non-rollup indices. Omitting the parameter or using _all are not permitted.
  • Multiple non-rollup indices may be specified.
  • Only one rollup index may be specified. If more than one are supplied, an exception occurs.
  • Wildcard expressions (*) may be used. If they match more than one rollup index, an exception occurs. However, you can use an expression to match multiple non-rollup indices or data streams.

Query parameters

rest_total_hits_as_int boolean · default: false

Indicates whether hits.total should be rendered as an integer or an object in the rest search response

typed_keys boolean · default: false

Specify whether aggregation and suggester names should be prefixed by their respective types in the response

Request body

aggregations map string to {} Aggregation

Specifies aggregations.

query {} Query

Specifies a DSL query that is subject to some limitations.

size number

Must be zero if set, as rollups work on pre-aggregated data.

Response

application/json
took number required
timed_out boolean required
terminated_early boolean
_shards object required
failed number required

The number of shards the operation or search attempted to run on but failed.

successful number required

The number of shards the operation or search succeeded on.

total number required

The number of shards the operation or search will run on overall.

failures object[]
index string
node string
reason object required
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as reason in failures
root_cause object[]
Same fields as reason in failures
suppressed object[]
Same fields as reason in failures
shard number
status string
primary boolean
skipped number
hits object required
total union oneOf

Total hit count information, present only if track_total_hits wasn't false in the search request.

One of:
relation enum required

Supported values include:

  • eq: Accurate
  • gte: Lower bound, including returned events or sequences
Values: eq gte
value number required
hits object[] required
_index string required
_id string
_score union number | string nullable
_explanation object
description string required
details object[] required
description string required
details object[]
Same fields as details in _explanation
value number required
value number required
fields map string to object
highlight map string to string
inner_hits map string to object
<string> object
hits object required
Same fields as hits
matched_queries union oneOf
One of: string[] or string to number
_nested object
field string required
offset number required
_nested object
Same fields as _nested in hits
_ignored string[]
ignored_field_values map string to object
_shard string
_node string
_routing string
_source object
_rank number
_seq_no number
_primary_term number
_version number
sort union[]
max_score union number | string nullable
aggregations map string to {} Aggregation result