How to find track_total_hits value for a specific point_in_time (pit_id)?

Plugins Security Analytics
1

I was expecting how much total hits is taken snapshot while creating the point in time id

Example:

When i create a PIT id for a specific index.
POST /value*/_search/point_in_time?keep_alive=1d

Now I need to slice the result into multiple pages so I need to give a max and id value for that eg:
{“query”:
{“bool”:
{“should”:[{“match_phrase”:{“host”:“General”}}],
“must”:[{“range”:{“@timestamp”:{“gte”:“now-1d”,“lt”:“now”}}}}},
“size”:10000,
“slice”:{“id”:0,“max”:100},
“pit”:{“id”:“xxxxxxxxxxxxxx”
}}

So in order to find the max value I need total logs count but in PIT I was unable to get to what are the total count of logs it have snapshot for that specific id

2

I think the max parameter in slice is not the total hit count, it’s just the number of slices, it can be the number of shards of the index.

3

Yes you are correct, max value represent the number of slices, I am working on pagination so I consider this max value as my page number so if I was able to get total hit count that was present for the specific pit id I can calculate how many slices/pages I need.

So I need to find how can we get the total hit count that was present during the pit id creation

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.