Get the async EQL status

  • GET /_eql/search/status/{id}
Auth

Get the current status for an async EQL search or a stored synchronous EQL search without returning results.

Required privileges

Cluster privileges monitor

Path parameters

id string required

Identifier for the search.

Response

application/json
id string required

Identifier for the search.

is_partial boolean required

If true, the search request is still executing. If false, the search is completed.

is_running boolean required

If true, the response does not contain complete search results. This could be because either the search is still running (is_running status is false), or because it is already completed (is_running status is true) and results are partial due to failures or timeouts.

start_time_in_millis number

For a running search shows a timestamp when the eql search started, in milliseconds since the Unix epoch.

expiration_time_in_millis number

Shows a timestamp when the eql search will be expired, in milliseconds since the Unix epoch. When this time is reached, the search and its results are deleted, even if the search is still ongoing.

completion_status number

For a completed search shows the http status code of the completed search.