Get the async EQL status

Identifier for the search.

If true, the search request is still executing. If false, the search is completed.

If true, the response does not contain complete search results. This could be because either the search is still running (is_running status is false), or because it is already completed (is_running status is true) and results are partial due to failures or timeouts.

For a running search shows a timestamp when the eql search started, in milliseconds since the Unix epoch.

Shows a timestamp when the eql search will be expired, in milliseconds since the Unix epoch. When this time is reached, the search and its results are deleted, even if the search is still ongoing.