Elasticsearch search API not returning all the results

Question

I have three indexes, all three of them share a particular key-value pair. When I do a blanket search with the api "http://localhost:9200/_search" using the request body

{"query":{
    "query_string":
    {
        "query":"city*"

        }
    }
}

It is only returning results from two of the indexes. I tried using the same request body by altering the url to search only in that missed index "http://localhost:9200/index_name/_search" and that's working. Am I missing anything here?

The code for inserting all three indexes follow the same procedure and I used elasticsearch-py to ingest the data.

I'm using the GET HTTP method and also tried the POST HTTP method. Both returns the same results. Elasticsearch version is 7.6.0.

Results for specific index search is like the one below

{
    "took": 1,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 1,
            "relation": "eq"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": "index_name",
                "_type": "meta",
                "_id": "LMRqDnIBh5wU6Ax_YsOD",
                "_score": 1.0,
                "_source": {
                    "table_schema": "test_table",
                    "table_name": "citymaster_old" 
                }
            }
        ]
    }
}

Fingernail

are you using the GET http method? also can you paste the response from your index specific search request, just want to make sure it doesn't return the all result, using GET http method doesn't work properly with some DSL. Also shouldn't cause the issue, but which version of Elasticsearch you are using? would like to reproduce the issue at my end. – Banish

@OpsterElasticsearchNinja Please check the updated question – Fingernail

Answer 1

The reason might be that you haven't provided the size parameter in the query. This limits the result count to 10 by default. Out of all the results the top 10 might be from the two index even thought the match is present in third index as well. This in turn giving the perception that result from third index are not being returned.

Try adding size parameter.

{
  "query": {
    "query_string": {
      "query": "city*"
    }
  },
  "size": 20
}

You can figure out the number of documents that matched the query by the total key in response

"total": {
            "value": 1,
            "relation": "eq"
        }

Pinto

Thanks that solved the issue :) Is there anything that we can add to the request body to return all matching results? instead of just limiting to one – Fingernail