I am working on a Python program that gives me statistics across all documents in a given Elastic Search index. Docs in our indexes have many fields that are not specifically mapped in the ES settings. They are just treated as opaque text strings (and we don’t search or aggregate by them).

Here’s what the script does in a nutshell

• It downloads every document in the given index (match_all without any selectors)

• It keeps a list of all fields that appear at least once in any document, in dot notation: FirstLevel.SecondLevelArray[..].ThirdLevel

• For each field, it counts how many docs have that field

• For each field, it lists the top 100 values that this field has across all docs (incl. how often that value appears in that field across all docs)

• Sample output: FirstLevel.SecondLevelArray[].ThirdLevel appears 9423 times. Top values: 1010 times Value1, 900 times Value2, 423 times Value3

This is a pretty handy tool for us to audit the documents we have in our index.

Naturally, getting all docs out of an index and then doing those counts can be very time-consuming. So I was wondering:

• Is there a built-in feature in ES that would give me such stats without having to do this myself?

• If not, instead of calling “match_all” to download all docs, is there a way to get a random “sample” of N documents, e.g. only return every 10th or 100th document?

Here’s the code snippet I run right now, getting me all documents between two dates:

from elasticsearch import Elasticsearch client = Elasticsearch("https://localhost:9200/")
QUERY_RANGE = { "range": { INDEX_FIELD_TIME: { "gte": DATE_START, "lte": DATE_END } } }
QUERY_RANGE_SORT = [ { INDEX_FIELD_TIME: "asc" }, { INDEX_FIELD_ID: "asc" } ] 
while True:
  resp = client.search(index=INDEX_NAME, query=QUERY_RANGE, size=5000, sort=QUERY_RANGE_SORT, search_after=[ 0, 0 ])
  # Write resp to file
  if len(resp['hits']['hits']) == 0:
    break    

How could I change that so I only get a sample of documents (e.g. every 10th or 100th)?

I read through random_sampler aggregation, but that relies on aggregations by certain fields, which I don’t want. I want a sample set of the entire document.