Count matching documents
countRead-only
Return the number of documents matching a DSL query without retrieving them. Provides raw OpenSearch response with match totals, flagging incomplete results when you need only the number.
Instructions
Count documents matching a DSL query clause, without returning the documents.
Use this instead of search_dsl when you only need the number of matches, not
the documents themselves. Note the query_dsl shape differs from search_dsl's —
the schema says how. Returns the raw OpenSearch _count response
({"count": N, ...}), with an "INCOMPLETE:" line above it when some shards
failed or the count timed out.
This tool takes no time arguments and applies no default window, so a
bare call counts everything the index still holds, which on any real
capture is millions of documents. Bound it with a range clause inside
query_dsl, use malcolm_search when you want a human-readable time range,
or arkime_sessions_summary when you want byte and packet totals beside
the count.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | No | Index or pattern to count over. Accepts a wildcard; default is the Malcolm sessions index. | arkime_sessions3-* |
| query_dsl | No | JSON string of the INNER DSL query clause only, e.g. {"term": {"event.dataset": "conn"}} (no "query" wrapper, no "aggs"/"size"). Empty counts all documents (match_all). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |