stack kb significantevents get-streams-name-significant-events cli command

elastic stack kb significantevents get-streams-name-significant-events \
  --name <name> \
  --from <from> \
  --to <to> \
  --bucket-size <bucket-size> \
  [options]
		

Read the significant events

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--name string required

The name of the stream.

--from string required

Start of the time range as an ISO 8601 date string.

--to string required

End of the time range as an ISO 8601 date string.

--bucket-size string required

The bucket size for aggregating events (e.g. "1m", "1h").

--query string

Query string to filter significant events on metadata fields

--search-mode enum

Search mode: keyword (BM25), semantic (vector), or hybrid (RRF). When omitted, defaults to hybrid with a silent keyword fallback on failure. When set explicitly, failures propagate as errors.

Values: keyword, semantic, hybrid

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON