---
type: api
title: Get async EQL search results
description: Get the current status and available results for an async EQL search or a stored synchronous EQL search.
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v9/operation/operation-eql-get
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/v9/operation/operation-eql-get
products:
  - Elasticsearch
---

# Get async EQL search results

Availability: Generally available since 7.9

## Paths

- `GET` `/_eql/search/{id}`

#### Path parameters

- `id` (string) — required
  Identifier for the search.

## Description

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)

## Query string parameters

- `keep_alive` (string · default: 5d) — optional
  Period for which the search and its results are stored on the cluster.
Defaults to the keep_alive value set by the search’s EQL search API request.
- `wait_for_completion_timeout` (string) — optional
  Timeout duration to wait for the request to finish.
Defaults to no timeout, meaning the request waits for complete search results.

## Response

`application/json`

- `id` (string)
  Identifier for the search.
- `is_partial` (boolean)
  If true, the response does not contain complete search results.
- `is_running` (boolean)
  If true, the search request is still executing.
- `took` (number)
  Milliseconds it took Elasticsearch to execute the request.
- `timed_out` (boolean)
  If true, the request timed out before completion.
- `hits` (object)
  Contains matching events and sequences. Also contains related metadata.
  - `total` (object)
    Metadata about the number of matching events or sequences.
    - `relation` (enum)
      

Supported values include:
  - `eq`: Accurate
  - `gte`: Lower bound, including returned events or sequences
      Values: `eq`, `gte`
    - `value` (number)
  - `events` (object[])
    Contains events matching the query. Each object represents a matching event.
    - `_index` (string)
      Name of the index containing the event.
    - `_id` (string)
      Unique identifier for the event. This ID is only unique within the index.
    - `_source` (object)
      Original JSON body passed for the event at index time.
    - `missing` (boolean)
      Set to `true` for events in a timespan-constrained sequence that do not meet a given condition.
    - `fields` (map string to object)
  - `sequences` (object[])
    Contains event sequences matching the query. Each object represents a matching sequence. This parameter is only returned for EQL queries containing a sequence.
    - `events` (object[])
      Contains events matching the query. Each object represents a matching event.
      - `_index` (string)
        Name of the index containing the event.
      - `_id` (string)
        Unique identifier for the event. This ID is only unique within the index.
      - `_source` (object)
        Original JSON body passed for the event at index time.
      - `missing` (boolean)
        Set to `true` for events in a timespan-constrained sequence that do not meet a given condition.
      - `fields` (map string to object)
    - `join_keys` (object[])
      Shared field values used to constrain matches in the sequence. These are defined using the by keyword in the EQL query syntax.
- `shard_failures` (object[])
  Contains information about shard failures (if any), in case allow_partial_search_results=true
  - `index` (string)
  - `node` (string)
  - `reason` (object)
    - `type` (string)
      The type of error
    - `reason` (union string) — nullable
      A human-readable explanation of the error, in English.
      One of: `string`
    - `stack_trace` (string)
      The server stack trace. Present only if the `error_trace=true` parameter was sent with the request.
    - `caused_by` (object) — recursive
      Same fields as `reason` in `shard_failures`
    - `root_cause` (object[]) — recursive
      Same fields as `reason` in `shard_failures`
    - `suppressed` (object[]) — recursive
      Same fields as `reason` in `shard_failures`
  - `shard` (number)
  - `status` (string)
  - `primary` (boolean)
## Code examples

#### Console

```console
GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s
```

#### JavaScript

```javascript
const response = await client.eql.get({
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s",
});
```

#### Python

```python
resp = client.eql.get(
    id="FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    wait_for_completion_timeout="2s",
)
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.eql().get(g -> g
    .id("FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=")
    .waitForCompletionTimeout(w -> w
        .time("2s")
    )
);
```

#### C#

```c#
var response = await client.Eql
    .GetAsync<MyDocument>(id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=", d1 => d1
        .WaitForCompletionTimeout("2s")
    );
```

#### PHP

```php
$resp = $client->eql()->get([
    "id" => "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    "wait_for_completion_timeout" => "2s",
]);
```

#### Ruby

```ruby
response = client.eql.get(
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s"
)
```