Search for saved objects

An aggregation structure, serialized as a string. The field format is similar to filter, meaning that to use a saved object type attribute in the aggregation, the savedObjectType.attributes.title: "myTitle" format must be used. For root fields, the syntax is savedObjectType.rootField. NOTE: As objects change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.

The default operator to use for the simple_query_string.

The fields to return in the attributes key of the response.

The filter is a KQL string with the caveat that if you filter with an attribute from your saved object type, it should look like that: savedObjectType.attributes.title: "myTitle". However, if you use a root attribute of a saved object such as updated_at, you will have to define your filter like that: savedObjectType.updated_at > 2018-12-22.

Filters to objects that do not have a relationship with the type and identifier combination.

The operator to use for the has_no_reference parameter. Either OR or AND. Defaults to OR.

Filters to objects that have a relationship with the type and ID combination.

The operator to use for the has_reference parameter. Either OR or AND. Defaults to OR.

The page of objects to return.

The number of objects to return per page.

An Elasticsearch simple_query_string query that filters the objects in the response.

The fields to perform the simple_query_string parsed query against.

Sorts the response. Includes "root" and "type" fields. "root" fields exist for all saved objects, such as "updated_at". "type" fields are specific to an object type, such as fields returned in the attributes key of the response. When a single type is defined in the type parameter, the "root" and "type" fields are allowed, and validity checks are made in that order. When multiple types are defined in the type parameter, only "root" fields are allowed.