Delete an async EQL search

  • DELETE /_eql/search/{id}
Auth

Delete an async EQL search or a stored synchronous EQL search. The API also deletes results for the search.

Path parameters

id string required

Identifier for the search to delete. A search ID is provided in the EQL search API's response for an async search. A search ID is also provided if the request’s keep_on_completion parameter is true.

Response

application/json
acknowledged boolean required

For a successful response, this value is always true. On failure, an exception is returned instead.