Run an ES|QL query
- POST /_query
Get search results for an ES|QL (Elasticsearch query language) query.
Read the reference documentationQuery Parameters
-
formatEsqlFormat A short version of the Accept header, e.g. json, yaml.
csv,tsv, andtxtformats will return results in a tabular format, excluding other metadata fields from the response.-
Values:
csvjsontsvtxtyamlcborsmilearrow -
delimiterstring · default: , The character to use between values within a CSV row. Only valid for the CSV format.
-
drop_null_columnsboolean · default: false Should columns that are entirely
nullbe removed from thecolumnsandvaluesportion of the results? Defaults tofalse. Iftruethen the response will include an extra section under the nameall_columnswhich has the name of all columns.-
allow_partial_resultsboolean · default: true If
true, partial results will be returned if there are shard failures, but the query can continue to execute on other clusters and shards. Iffalse, the query will fail if there are any failures.To override the default behavior, you can set the
esql.query.allow_partial_resultscluster setting tofalse.
Request
-
columnarboolean -
By default, ES|QL returns results as rows. For example, FROM returns each individual document as one row. For the JSON, YAML, CBOR and smile formats, ES|QL can return the results in a columnar fashion where one row represents all the values of a certain column in the results.
-
filterQueryContainer -
Specify a Query DSL query in the filter parameter to filter the set of documents that an ES|QL query runs on.
-
localestring -
paramsESQLParams -
To avoid any attempts of hacking or code injection, extract the values in a separate list of parameters. Use question mark placeholders (?) in the query string for each of the parameters.
-
profileboolean -
If provided and
truethe response will include an extraprofileobject with information on how the query was executed. This information is for human debugging and its format can change at any time but it can give some insight into the performance of each part of the query. -
querystringrequired -
The ES|QL query API accepts an ES|QL query string in the query parameter, runs it, and returns the results.
-
tablesmap string to string to TableValuesContainer -
Tables to use with the LOOKUP operation. The top level key is the table name and the next level key is the column name.
-
include_ccs_metadataboolean · default: false -
When set to
trueand performing a cross-cluster query, the response will include an extra_clustersobject with information about the clusters that participated in the search along with info such as shards count.
Response
-
tookDurationValueUnitMillis -
is_partialboolean -
all_columnsEsqlColumnInfo -
valuesFieldValuerequired -
_clustersEsqlClusterInfo -
Cross-cluster search information. Present if
include_ccs_metadatawastruein the request and a cross-cluster search was performed. -
totalnumberrequired -
successfulnumberrequired -
runningnumberrequired -
skippednumberrequired -
partialnumberrequired -
failednumberrequired -
detailsmap string to EsqlClusterDetailsrequired -
<string>EsqlClusterDetails -
statusEsqlClusterStatusrequired -
Values:
runningsuccessfulpartialskippedfailed -
indicesstringrequired -
tookDurationValueUnitMillis -
_shardsEsqlShardInfo -
totalnumberrequired -
successfulnumber -
skippednumber -
failednumber -
failuresEsqlShardFailure -
shardstring Idrequired -
indexstring IndexNamerequired -
nodestring -
reasonErrorCauserequired -
typestringrequired -
The type of error
-
reasonstringnullable -
A human-readable explanation of the error, in English.
-
stack_tracestring -
The server stack trace. Present only if the
error_trace=trueparameter was sent with the request. -
caused_byErrorCause -
root_causeErrorCause -
suppressedErrorCause -
profileobject -
Profiling information. Present if
profilewastruein the request. The contents of this field are currently unstable.