From dce942f39913f7b4dc06f34cff2a4fb45e16b7b2 Mon Sep 17 00:00:00 2001
From: Wolfgang Braun <wolfgang.braun@funktionslust.digital>
Date: Tue, 18 Feb 2020 12:33:20 +0100
Subject: [PATCH 1/3] add new include_hits config

---
 lib/logstash/filters/elasticsearch.rb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/logstash/filters/elasticsearch.rb b/lib/logstash/filters/elasticsearch.rb
index 6de224e..c506188 100644
--- a/lib/logstash/filters/elasticsearch.rb
+++ b/lib/logstash/filters/elasticsearch.rb
@@ -64,6 +64,9 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
   # Whether results should be sorted or not
   config :enable_sort, :validate => :boolean, :default => true
 
+  # Whether to set hits to metadata
+  config :include_hits, :validate => :boolean, :default => true
+
   # How many results to return
   config :result_size, :validate => :number, :default => 1
 
@@ -116,6 +119,9 @@ def filter(event)
 
       resultsHits = results["hits"]["hits"]
       if !resultsHits.nil? && !resultsHits.empty?
+        if @include_hits
+          event.set("[@metadata][hits]", resultsHits)
+        end
         matched = true
         @fields.each do |old_key, new_key|
           old_key_path = extract_path(old_key)

From 871008c28c86fdfb020c31445afee064dd855060 Mon Sep 17 00:00:00 2001
From: Wolfgang Braun <wolfgang.braun@funktionslust.digital>
Date: Tue, 18 Feb 2020 16:19:37 +0100
Subject: [PATCH 2/3] better default value for include_hits

---
 lib/logstash/filters/elasticsearch.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/logstash/filters/elasticsearch.rb b/lib/logstash/filters/elasticsearch.rb
index c506188..9594468 100644
--- a/lib/logstash/filters/elasticsearch.rb
+++ b/lib/logstash/filters/elasticsearch.rb
@@ -65,7 +65,7 @@ class LogStash::Filters::Elasticsearch < LogStash::Filters::Base
   config :enable_sort, :validate => :boolean, :default => true
 
   # Whether to set hits to metadata
-  config :include_hits, :validate => :boolean, :default => true
+  config :include_hits, :validate => :boolean, :default => false
 
   # How many results to return
   config :result_size, :validate => :number, :default => 1

From ac91a1a15f337032823314cdbc8cdbfd3917c375 Mon Sep 17 00:00:00 2001
From: Wolfgang Braun <wolfgang.braun@funktionslust.digital>
Date: Sat, 22 Feb 2020 09:49:53 +0100
Subject: [PATCH 3/3] extend docs

---
 docs/index.asciidoc | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index bd44e2c..fea00b5 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -126,6 +126,7 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-cloud_id>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-docinfo_fields>> |<<hash,hash>>|No
 | <<plugins-{type}s-{plugin}-enable_sort>> |<<boolean,boolean>>|No
+| <<plugins-{type}s-{plugin}-include_hits>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-fields>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-hosts>> |<<array,array>>|No
 | <<plugins-{type}s-{plugin}-index>> |<<string,string>>|No
@@ -190,13 +191,21 @@ Example:
     }
 
 [id="plugins-{type}s-{plugin}-enable_sort"]
-===== `enable_sort` 
+===== `enable_sort`
 
   * Value type is <<boolean,boolean>>
   * Default value is `true`
 
 Whether results should be sorted or not
 
+[id="plugins-{type}s-{plugin}-include_hits"]
+===== `include_hits`
+
+  * Value type is <<boolean,boolean>>
+  * Default value is `false`
+
+Whether the full list of hits should be applied to `[@metadata][hits]`.
+
 [id="plugins-{type}s-{plugin}-fields"]
 ===== `fields`