title: Getting `n` records for every match in elasticsearch
body: <p>I have an elastic query as follows:  </p>
  
  <pre><code>GET /logs-of-year-2019.03.*/_search
  {
    "sort": [
      {
         "@timestamp": "desc"
      }
    ],
    "query": {
      "bool": {
        "must": [
          {
            "terms": {
              "Request.advertiserId": [1695, 1252]
            }
          }
        ],
        "filter": [
          {
            "range": {
              "@timestamp": {
                "gte": "now-5h/d",
                "lte": "now/d"
              }
            }
          }
        ]
      }
    }
  }  
  </code></pre>
  
  <p>This query gets all documents with <code>Request.advertiserId</code> as either <code>1695</code> or <code>1252</code>. With a filter on <code>@timestamp</code>. </p>
  
  <p>The result has <code>hits</code> bucket in it which has <code>10</code>results within it with a combination of a few results with <code>1695</code> and a few with <code>1252</code>. What I want to achieve is that I need <code>20</code>(any specified <code>n</code>) documents for each specified <code>Request.advertiserId</code>. In other words, <code>20 documents</code> for <code>1695</code> and <code>20</code> for <code>1252</code>. Is this thing achievable with just 1 elastic query?</p>
  
  <p>What I can think as of now is fire different query for each <code>Request.advertiserId</code> and specify <code>size=20</code> (this can be a variable <code>n</code>). But then I will have to fire <code>m</code> queries for <code>m</code> number of  <code>Request.advertiserId</code>. Can this be achieved in 1 single query?</p>
  
  <p>PS: <code>GET /logs-of-year-2019.03.*/_search</code><br>
  The above line states that logs from all dates of the specified month needs to be scanned. The indexes are stored as <code>logs-of-year-2019.03.01-05</code>(logs for <code>5th</code> hour on 1st march 2019), <code>logs-of-year-2019.03.01-06</code> (logs for <code>6th</code> hour on 1st march 2019), and so on. The logs are created per hour per day. Can the above line be optimized such that it checks for indexes for only 5 hours from <code>now</code> (Can involve previous day as the search can be run at 0100 at night. So it should involve 21 to 00 hours from previous date and 00 to 01 hours for today's date) and not for entire month?</p>