---
type: api
title: Get async EQL search results
description: Get the current status and available results for an async EQL search or a stored synchronous EQL search.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-eql-get
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/operation/operation-eql-get
products:
  - Elasticsearch Serverless
---

# Get async EQL search results

Availability:

## Paths

- `GET` `/_eql/search/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch-serverless/authentication#apikeyauth)

#### Path Parameters

- `id` (string Id)
  Identifier for the search.

## Description

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

## Query String Parameters

- `keep_alive` (string Duration · default: 5d)
  Period for which the search and its results are stored on the cluster.
Defaults to the keep_alive value set by the search’s EQL search API request.
- `wait_for_completion_timeout` (string Duration)
  Timeout duration to wait for the request to finish.
Defaults to no timeout, meaning the request waits for complete search results.

## Response

`application/json`

- `id` (string Id)
  Identifier for the search.
- `is_partial` (boolean)
  If true, the response does not contain complete search results.
- `is_running` (boolean)
  If true, the search request is still executing.
- `took` (DurationValueUnitMillis)
  Milliseconds it took Elasticsearch to execute the request.
- `timed_out` (boolean)
  If true, the request timed out before completion.
- `hits` ({} EqlHits)
  Contains matching events and sequences. Also contains related metadata.
  - `total` ({} TotalHits)
    Metadata about the number of matching events or sequences.
    - `relation` (enum TotalHitsRelation)
      

Supported values include:
  - `eq`: Accurate
  - `gte`: Lower bound, including returned events or sequences
      Values: `eq`, `gte`
    - `value` (number)
  - `events` ([] HitsEvent)
    Contains events matching the query. Each object represents a matching event.
    - `_index` (string IndexName)
      Name of the index containing the event.
    - `_id` (string Id)
      Unique identifier for the event. This ID is only unique within the index.
    - `_source` (object)
      Original JSON body passed for the event at index time.
    - `missing` (boolean)
      Set to `true` for events in a timespan-constrained sequence that do not meet a given condition.
    - `fields` (map string to object)
  - `sequences` ([] HitsSequence)
    Contains event sequences matching the query. Each object represents a matching sequence. This parameter is only returned for EQL queries containing a sequence.
    - `events` ([] HitsEvent)
      Contains events matching the query. Each object represents a matching event.
      - `_index` (string IndexName)
        Name of the index containing the event.
      - `_id` (string Id)
        Unique identifier for the event. This ID is only unique within the index.
      - `_source` (object)
        Original JSON body passed for the event at index time.
      - `missing` (boolean)
        Set to `true` for events in a timespan-constrained sequence that do not meet a given condition.
      - `fields` (map string to object)
    - `join_keys` ([] object)
      Shared field values used to constrain matches in the sequence. These are defined using the by keyword in the EQL query syntax.
- `shard_failures` ([] ShardFailure)
  Contains information about shard failures (if any), in case allow_partial_search_results=true
  - `index` (string IndexName)
  - `node` (string)
  - `reason` ({} ErrorCause)
    - `type` (string)
      The type of error
    - `reason` (union string) — nullable
      A human-readable explanation of the error, in English.
      One of: `string`
    - `stack_trace` (string)
      The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
    - `caused_by` ({} ErrorCause) — recursive
      Same fields as `reason` in `shard_failures`
    - `root_cause` ([] ErrorCause) — recursive
      Same fields as `reason` in `shard_failures`
    - `suppressed` ([] ErrorCause) — recursive
      Same fields as `reason` in `shard_failures`
  - `shard` (number)
  - `status` (string)
  - `primary` (boolean)
## Code Examples

#### Console

```console
GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s
```

#### JavaScript

```javascript
const response = await client.eql.get({
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s",
});
```

#### Python

```python
resp = client.eql.get(
    id="FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    wait_for_completion_timeout="2s",
)
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.eql().get(g -> g
    .id("FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=")
    .waitForCompletionTimeout(w -> w
        .time("2s")
    )
);
```

#### C#

```c#
var response = await client.Eql
    .GetAsync<MyDocument>(id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=", d1 => d1
        .WaitForCompletionTimeout("2s")
    );
```

#### PHP

```php
$resp = $client->eql()->get([
    "id" => "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    "wait_for_completion_timeout" => "2s",
]);
```

#### Ruby

```ruby
response = client.eql.get(
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s"
)
```