Run multiple Fleet searches

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

Supported values include:

• all: Match any data stream or index, including hidden ones.
• open: Match open, non-hidden indices. Also matches any non-hidden data stream.
• closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
• hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
• none: Wildcard expressions are not accepted.

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

A custom value used to route operations to a specific shard. Not allowed when index.slice.enabled is true for the target index; use _slice instead.

Supported values include:

• query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.
• dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.

Defines the aggregations that are run as part of the search request.

If true, the request returns detailed information about score computation as part of a hit.

Configuration of search extensions defined by Elasticsearch plugins.

The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.

Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query.

Boost the _score of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than 1.0 increases the score. A boost value between 0 and 1.0 decreases the score.

The minimum _score for matching documents. Documents with a lower _score are not included in search results or results collected by aggregations.

Use the post_filter parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results.

Set to true to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.

The search definition using the Query DSL.

Used to retrieve the next page of hits using a set of sort values from the previous page.

The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after property.

A comma-separated list of

The source fields that are returned for matching documents. These fields are returned in the hits._source property of the search response. If the stored_fields property is specified, the _source property defaults to false. Otherwise, it defaults to true.

The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.

IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.

If set to 0 (default), the query does not terminate early.

The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.

If true, calculate and return document scores, even if the scores are not used for sorting.

If true, the request returns the document version as part of a hit.

If true, the request returns sequence number and primary term of the last modification of each hit.

A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the _source property defaults to false. You can pass _source: true to return both source fields and stored fields in the search response.

One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.