APIs
  • Elasticsearch API
    Back to hub Cloud Billing API Elastic Cloud API Elastic Cloud Connected API Elastic Cloud Enterprise API Elastic Cloud Serverless API Elasticsearch API Elasticsearch Serverless API Kibana APIs Kibana Serverless APIs Logstash APIs
  • Download source
    JSON YAML
  1. APIs /
  2. Elasticsearch API

EQL

View as Markdown

Event Query Language (EQL) is a query language for event-based time series data, such as logs, metrics, and traces.

Learn more about EQL search.

4 endpoints

  • Get async EQL search results
    • GET /_eql/search/{id}
  • Delete an async EQL search
    • DELETE /_eql/search/{id}
  • Get the async EQL status
    • GET /_eql/search/status/{id}
  • Get EQL search results
    • POST also GET /{index}/_eql/search
v9
latest v9 v8
  • Authentication
  • Behavioral analytics
    • Get behavioral analytics collections GET
    • Create a behavioral analytics collection PUT
    • Delete a behavioral analytics collection DELETE
    • Create a behavioral analytics collection event POST
  • Cluster
    • Explain the shard allocations POST
    • Update voting configuration exclusions POST
    • Clear cluster voting config exclusions DELETE
    • Get cluster-wide settings GET
    • Update the cluster settings PUT
    • Get the cluster health status GET
    • Get cluster info GET
    • Get the pending cluster tasks GET
    • Get remote cluster information GET
    • Reroute the cluster POST
    • Get the cluster state GET
    • Get cluster statistics GET
    • Ping the cluster HEAD
    • Clear the archived repositories metering DELETE
    • Get cluster repositories metering GET
    • Get the hot threads for nodes GET
    • Get node information GET
    • Reload the keystore on nodes in the cluster POST
    • Get node statistics GET
    • Get feature usage information GET
  • Cluster - Health
    • Get the cluster health GET
  • Compact and aligned text (CAT)
    • Get aliases GET
    • Get shard allocation information GET
    • Get circuit breakers statistics GET
    • Get component templates GET
    • Get a document count GET
    • Get field data cache information GET
    • Get the cluster health status GET
    • Get CAT help GET
    • Get index information GET
    • Get master node information GET
    • Get data frame analytics jobs GET
    • Get datafeeds GET
    • Get anomaly detection jobs GET
    • Get trained models GET
    • Get node attribute information GET
    • Get node information GET
    • Get pending task information GET
    • Get plugin information GET
    • Get shard recovery information GET
    • Get snapshot repository information GET
    • Get segment information GET
    • Get shard information GET
    • Get snapshot information GET
    • Get task information GET
    • Get index template information GET
    • Get thread pool statistics GET
    • Get transform information GET
  • Connector
    • Check in a connector PUT
    • Get a connector GET
    • Create or update a connector PUT
    • Delete a connector DELETE
    • Get all connectors GET
    • Create a connector POST
    • Cancel a connector sync job PUT
    • Check in a connector sync job PUT
    • Claim a connector sync job PUT
    • Get a connector sync job GET
    • Delete a connector sync job DELETE
    • Set a connector sync job error PUT
    • Get all connector sync jobs GET
    • Create a connector sync job POST
    • Set the connector sync job stats PUT
    • Activate the connector draft filter PUT
    • Update the connector API key ID PUT
    • Update the connector configuration PUT
    • Update the connector error field PUT
    • Update the connector features PUT
    • Update the connector filtering PUT
    • Update the connector draft filtering validation PUT
    • Update the connector index name PUT
    • Update the connector name and description PUT
    • Update the connector is_native flag PUT
    • Update the connector pipeline PUT
    • Update the connector scheduling PUT
    • Update the connector service type PUT
    • Update the connector status PUT
  • Cross-cluster replication
    • Get auto-follow patterns GET
    • Create or update auto-follow patterns PUT
    • Delete auto-follow patterns DELETE
    • Create a follower PUT
    • Get follower information GET
    • Get follower stats GET
    • Forget a follower POST
    • Pause an auto-follow pattern POST
    • Pause a follower POST
    • Resume an auto-follow pattern POST
    • Resume a follower POST
    • Get cross-cluster replication stats GET
    • Unfollow an index POST
  • Data stream
    • Get data streams GET
    • Create a data stream PUT
    • Delete data streams DELETE
    • Get data stream stats GET
    • Get data stream lifecycles GET
    • Update data stream lifecycles PUT
    • Get data stream options GET
    • Update data stream options PUT
    • Delete data stream options DELETE
    • Downsample an index POST
    • Get the status for a data stream lifecycle GET
    • Get data stream lifecycle stats GET
    • Get data stream mappings GET
    • Update data stream mappings PUT
    • Get data stream settings GET
    • Update data stream settings PUT
    • Convert an index alias to a data stream POST
    • Update data streams POST
    • Promote a data stream POST
  • Document
    • Bulk index or delete documents PUT
    • Create a new document in the index POST
    • Get a document by its ID GET
    • Create or update a document in an index POST
    • Delete a document DELETE
    • Check a document HEAD
    • Delete documents POST
    • Throttle a delete by query operation POST
    • Get a document's source GET
    • Check for a document source HEAD
    • Reindex documents POST
    • Get multiple documents POST
    • Get multiple term vectors POST
    • Throttle a reindex operation POST
    • Get term vector information POST
    • Update a document POST
    • Update documents POST
    • Throttle an update by query operation POST
  • Enrich
    • Get an enrich policy GET
    • Create an enrich policy PUT
    • Delete an enrich policy DELETE
    • Run an enrich policy PUT
    • Get enrich stats GET
  • EQL
    • Get async EQL search results GET
    • Delete an async EQL search DELETE
    • Get the async EQL status GET
    • Get EQL search results POST
  • ES|QL
    • Run an async ES|QL query POST
    • Get async ES|QL query results GET
    • Delete an async ES|QL query DELETE
    • Stop async ES|QL query POST
    • Get ES|QL data sources GET
    • Create or update an ES|QL data source PUT
    • Delete ES|QL data sources DELETE
    • Get ES|QL datasets GET
    • Create or update an ES|QL dataset PUT
    • Delete ES|QL datasets DELETE
    • Get an ES|QL view GET
    • Create or update an ES|QL view PUT
    • Delete an ES|QL view DELETE
    • Get a specific running ES|QL query information GET
    • Get running ES|QL queries information GET
    • Run an ES|QL query POST
  • Features
    • Get the features GET
    • Reset the features POST
  • Fleet
    • Get global checkpoints GET
    • Run multiple Fleet searches POST
    • Run a Fleet search POST
  • Graph explore
    • Explore graph analytics POST
  • Index
    • Get component templates GET
    • Create or update a component template POST
    • Delete component templates DELETE
    • Check component templates HEAD
    • Import a dangling index POST
    • Delete a dangling index DELETE
    • Get the dangling indices GET
    • Add an index block PUT
    • Remove an index block DELETE
    • Get tokens from text analysis POST
    • Clear the cache POST
    • Clone an index POST
    • Close an index POST
    • Get index information GET
    • Create an index PUT
    • Delete indices DELETE
    • Check indices HEAD
    • Create or update an alias POST
    • Delete an alias DELETE
    • Delete data stream lifecycles DELETE
    • Get index templates GET
    • Create or update an index template POST
    • Delete an index template DELETE
    • Check index templates HEAD
    • Get legacy index templates GET
    • Create or update a legacy index template POST
    • Delete a legacy index template DELETE
    • Check existence of index templates HEAD
    • Analyze the index disk usage POST
    • Get aliases GET
    • Check aliases HEAD
    • Get field usage stats GET
    • Flush data streams or indices GET
    • Force a merge POST
    • Get mapping definitions GET
    • Get mapping definitions GET
    • Update field mappings POST
    • Get index settings GET
    • Open a closed index POST
    • Update index settings PUT
    • Get index recovery information GET
    • Refresh an index GET
    • Reload search analyzers POST
    • Resolve the cluster GET
    • Resolve indices POST
    • Roll over to a new index POST
    • Get index segments GET
    • Get index shard stores GET
    • Shrink an index POST
    • Simulate an index POST
    • Simulate an index template POST
    • Split an index POST
    • Get index statistics GET
    • Create or update an alias POST
    • Validate a query POST
  • Index lifecycle management
    • Get lifecycle policies GET
    • Create or update a lifecycle policy PUT
    • Delete a lifecycle policy DELETE
    • Explain the lifecycle state GET
    • Get the ILM status GET
    • Migrate to data tiers routing POST
    • Move to a lifecycle step POST
    • Remove policies from an index POST
    • Retry a policy POST
    • Start the ILM plugin POST
    • Stop the ILM plugin POST
  • Inference
    • Perform chat completion inference on the service POST
    • Perform completion inference on the service POST
    • Get an inference endpoint GET
    • Create an inference endpoint PUT
    • Perform inference on the service POST
    • Delete an inference endpoint DELETE
    • Get the inference region policy GET
    • Create or update the inference region policy PUT
    • Delete the inference region policy DELETE
    • Perform dense embedding inference on the service POST
    • Create a AI21 inference endpoint PUT
    • Create an AlibabaCloud AI Search inference endpoint PUT
    • Create an Amazon Bedrock inference endpoint PUT
    • Create an Amazon SageMaker inference endpoint PUT
    • Create an Anthropic inference endpoint PUT
    • Create an Azure AI studio inference endpoint PUT
    • Create an Azure OpenAI inference endpoint PUT
    • Create a Cohere inference endpoint PUT
    • Create an Contextual AI inference endpoint PUT
    • Create a custom inference endpoint PUT
    • Create a DeepSeek inference endpoint PUT
    • Create an Elasticsearch inference endpoint PUT
    • Create an ELSER inference endpoint PUT
    • Create a Fireworks AI inference endpoint PUT
    • Create an Google AI Studio inference endpoint PUT
    • Create a Google Vertex AI inference endpoint PUT
    • Create a Groq inference endpoint PUT
    • Create a Hugging Face inference endpoint PUT
    • Create an JinaAI inference endpoint PUT
    • Create a Llama inference endpoint PUT
    • Create a Mistral inference endpoint PUT
    • Create an Nvidia inference endpoint PUT
    • Create an OpenAI inference endpoint PUT
    • Create an OpenShift AI inference endpoint PUT
    • Create a VoyageAI inference endpoint PUT
    • Create a Watsonx inference endpoint PUT
    • Perform reranking inference on the service POST
    • Perform sparse embedding inference on the service POST
    • Perform streaming completion inference on the service POST
    • Perform text embedding inference on the service POST
    • Update an inference endpoint PUT
  • Info
    • Get cluster info GET
  • Ingest
    • Get GeoIP database configurations GET
    • Create or update a GeoIP database configuration PUT
    • Delete GeoIP database configurations DELETE
    • Get IP geolocation database configurations GET
    • Create or update an IP geolocation database configuration PUT
    • Delete IP geolocation database configurations DELETE
    • Get pipelines GET
    • Create or update a pipeline PUT
    • Delete pipelines DELETE
    • Get GeoIP statistics GET
    • Run a grok processor GET
    • Simulate a pipeline POST
    • Simulate data ingestion POST
  • Licensing
    • Get license information GET
    • Update the license POST
    • Delete the license DELETE
    • Get the basic license status GET
    • Get the trial status GET
    • Start a basic license POST
    • Start a trial POST
  • Logstash
    • Get Logstash pipelines GET
    • Create or update a Logstash pipeline PUT
    • Delete a Logstash pipeline DELETE
  • Machine learning
    • Get machine learning memory usage info GET
    • Get machine learning information GET
    • Set upgrade_mode for ML indices POST
  • Machine learning anomaly detection
    • Close anomaly detection jobs POST
    • Create a calendar PUT
    • Get calendar configuration info POST
    • Delete a calendar DELETE
    • Delete events from a calendar DELETE
    • Add anomaly detection job to calendar PUT
    • Delete anomaly jobs from a calendar DELETE
    • Get datafeeds configuration info GET
    • Create a datafeed PUT
    • Delete a datafeed DELETE
    • Delete expired ML data DELETE
    • Get filters GET
    • Create a filter PUT
    • Delete a filter DELETE
    • Delete forecasts from a job DELETE
    • Get anomaly detection jobs configuration info GET
    • Create an anomaly detection job PUT
    • Delete an anomaly detection job DELETE
    • Get model snapshots info POST
    • Delete a model snapshot DELETE
    • Estimate job model memory usage POST
    • Force buffered data to be processed POST
    • Predict future behavior of a time series POST
    • Get anomaly detection job results for buckets POST
    • Get info about events in calendars GET
    • Add scheduled events to the calendar POST
    • Get anomaly detection job results for categories POST
    • Get datafeed stats GET
    • Get anomaly detection job results for influencers POST
    • Get anomaly detection job stats GET
    • Get anomaly detection job model snapshot upgrade usage info GET
    • Get overall bucket results POST
    • Get anomaly records for an anomaly detection job POST
    • Open anomaly detection jobs POST
    • Send data to an anomaly detection job for analysis POST
    • Preview a datafeed POST
    • Reset an anomaly detection job POST
    • Revert to a snapshot POST
    • Start datafeeds POST
    • Stop datafeeds POST
    • Update a datafeed POST
    • Update a filter POST
    • Update an anomaly detection job POST
    • Update a snapshot POST
    • Upgrade a snapshot POST
  • Machine learning data frame analytics
    • Get data frame analytics job configuration info GET
    • Create a data frame analytics job PUT
    • Delete a data frame analytics job DELETE
    • Evaluate data frame analytics POST
    • Explain data frame analytics config POST
    • Get data frame analytics job stats GET
    • Preview features used by data frame analytics POST
    • Start a data frame analytics job POST
    • Stop data frame analytics jobs POST
    • Update a data frame analytics job POST
  • Machine learning trained model
    • Clear trained model deployment cache POST
    • Get trained model configuration info GET
    • Create a trained model PUT
    • Delete an unreferenced trained model DELETE
    • Create or update a trained model alias PUT
    • Delete a trained model alias DELETE
    • Get trained models usage info GET
    • Evaluate a trained model POST
    • Create part of a trained model definition PUT
    • Create a trained model vocabulary PUT
    • Start a trained model deployment POST
    • Stop a trained model deployment POST
    • Update a trained model deployment POST
  • Migration
    • Cancel a migration reindex operation POST
    • Create an index from a source index POST
    • Get the migration reindexing status GET
    • Reindex legacy backing indices POST
    • Get deprecation information GET
    • Get feature migration information GET
    • Start the feature migration POST
  • Query rules
    • Get a query rule GET
    • Create or update a query rule PUT
    • Delete a query rule DELETE
    • Get a query ruleset GET
    • Create or update a query ruleset PUT
    • Delete a query ruleset DELETE
    • Get all query rulesets GET
    • Test a query ruleset POST
  • Reindex
    • Cancel an ongoing reindex task POST
    • Get the status and progress of a specific reindex task GET
    • Get information about all currently running reindex tasks GET
  • Rollup
    • Get rollup job information GET
    • Create a rollup job PUT
    • Delete a rollup job DELETE
    • Get the rollup job capabilities GET
    • Get the rollup index capabilities GET
    • Search rolled-up data POST
    • Start rollup jobs POST
    • Stop rollup jobs POST
  • Script
    • Get a script or search template GET
    • Delete a script or search template DELETE
    • Get script contexts GET
    • Get script languages GET
    • Create or update a script or search template POST
    • Run a script POST
  • Search
    • Get async search results GET
    • Delete an async search DELETE
    • Get the async search status GET
    • Run an async search POST
    • Run a scrolling search POST
    • Clear a scrolling search DELETE
    • Close a point in time DELETE
    • Count search results GET
    • Explain a document match result POST
    • Get the field capabilities POST
    • Run multiple searches POST
    • Run multiple templated searches POST
    • Open a point in time POST
    • Evaluate ranked search results POST
    • Render a search template POST
    • Run a search POST
    • Search a vector tile GET
    • Get the search shards POST
    • Run a search with a search template POST
    • Get terms in an index POST
  • Search application
    • Get search application details GET
    • Create or update a search application PUT
    • Delete a search application DELETE
    • Get search applications GET
    • Render a search application query POST
    • Run a search application search POST
  • Searchable snapshots
    • Get cache statistics GET
    • Clear the cache POST
    • Mount a snapshot POST
    • Get searchable snapshot statistics GET
  • Security
    • Reset the project encryption key POST
    • Activate a user profile POST
    • Authenticate a user GET
    • Bulk create or update roles POST
    • Bulk delete roles DELETE
    • Bulk update API keys POST
    • Change passwords POST
    • Clear the API key cache POST
    • Clear the privileges cache POST
    • Clear the user cache POST
    • Clear the roles cache POST
    • Clear service account token caches POST
    • Clone an API key PUT
    • Get API key information GET
    • Create an API key POST
    • Invalidate API keys DELETE
    • Create a cross-cluster API key POST
    • Create a service account token POST
    • Delete service account tokens DELETE
    • Delegate PKI authentication POST
    • Get application privileges GET
    • Delete application privileges DELETE
    • Get roles GET
    • Create or update roles POST
    • Delete roles DELETE
    • Get role mappings GET
    • Create or update role mappings POST
    • Delete role mappings DELETE
    • Get users GET
    • Create or update users POST
    • Delete users DELETE
    • Disable users POST
    • Disable a user profile POST
    • Enable users POST
    • Enable a user profile POST
    • Enroll Kibana GET
    • Enroll a node GET
    • Get builtin privileges GET
    • Get service accounts GET
    • Get service account credentials GET
    • Get security index settings GET
    • Update security index settings PUT
    • Get security stats GET
    • Get a token POST
    • Invalidate a token DELETE
    • Get user privileges GET
    • Get a user profile GET
    • Grant an API key POST
    • Check user privileges POST
    • Check user profile privileges POST
    • Authenticate OpenID Connect POST
    • Logout of OpenID Connect POST
    • Prepare OpenID connect authentication POST
    • Create or update application privileges POST
    • Find API keys with a query POST
    • Find roles with a query POST
    • Find users with a query POST
    • Authenticate SAML POST
    • Logout of SAML completely POST
    • Invalidate SAML POST
    • Logout of SAML POST
    • Prepare SAML authentication POST
    • Create SAML service provider metadata GET
    • Suggest a user profile POST
    • Update an API key PUT
    • Update a cross-cluster API key PUT
    • Update user profile data POST
    • Get SSL certificates GET
  • Snapshot and restore
    • Clean up the snapshot repository POST
    • Clone a snapshot PUT
    • Get snapshot information GET
    • Create a snapshot POST
    • Delete snapshots DELETE
    • Get snapshot repository information GET
    • Create or update a snapshot repository POST
    • Delete snapshot repositories DELETE
    • Analyze a snapshot repository POST
    • Verify the repository integrity POST
    • Restore a snapshot POST
    • Get the snapshot status GET
    • Verify a snapshot repository POST
  • Snapshot lifecycle management
    • Get policy information GET
    • Create or update a policy PUT
    • Delete a policy DELETE
    • Run a policy PUT
    • Run a retention policy POST
    • Get snapshot lifecycle management statistics GET
    • Get the snapshot lifecycle management status GET
    • Start snapshot lifecycle management POST
    • Stop snapshot lifecycle management POST
  • SQL
    • Clear an SQL search cursor POST
    • Delete an async SQL search DELETE
    • Get async SQL search results GET
    • Get the async SQL search status GET
    • Get SQL search results GET
    • Translate SQL into Elasticsearch queries GET
  • Streams
    • Disable a named stream POST
    • Enable a named stream POST
    • Get the status of streams GET
  • Synonyms
    • Get a synonym set GET
    • Create or update a synonym set PUT
    • Delete a synonym set DELETE
    • Get a synonym rule GET
    • Create or update a synonym rule PUT
    • Delete a synonym rule DELETE
    • Get all synonym sets GET
  • Task management
    • Cancel a task POST
    • Get task information GET
    • Get all tasks GET
  • Text structure
    • Find the structure of a text field GET
    • Find the structure of text messages POST
    • Find the structure of a text file POST
    • Test a Grok pattern POST
  • Transform
    • Get transforms GET
    • Create a transform PUT
    • Delete a transform DELETE
    • Get node stats GET
    • Get transform stats GET
    • Preview a transform POST
    • Reset a transform POST
    • Schedule a transform to start now POST
    • Set upgrade_mode for transform indices POST
    • Start a transform POST
    • Stop transforms POST
    • Update a transform POST
    • Upgrade all transforms POST
  • Usage
    • Get information GET
    • Get usage information GET
  • Watcher
    • Acknowledge a watch POST
    • Activate a watch POST
    • Deactivate a watch POST
    • Get a watch GET
    • Create or update a watch POST
    • Delete a watch DELETE
    • Run a watch POST
    • Get Watcher index settings GET
    • Update Watcher index settings PUT
    • Query watches POST
    • Start the watch service POST
    • Get Watcher statistics GET
    • Stop the watch service POST
  • Types
    • Query DSL
      • QueryContainer
    • Aggregations
      • AggregationContainer
      • Aggregate
    • Ingest
      • ProcessorContainer
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2026 Elasticsearch B.V. All Rights Reserved.

This content is available in different formats for convenience only. All original licensing terms apply.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Notice at Collection | Your Privacy Choices