Get async EQL search results

  • GET /_eql/search/{id}
Auth

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

Path parameters

id string required

Identifier for the search.

Query parameters

keep_alive string · default: 5d

Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.

wait_for_completion_timeout string

Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.

Reference

Response

application/json
id string

Identifier for the search.

is_partial boolean

If true, the response does not contain complete search results.

is_running boolean

If true, the search request is still executing.

took number

Milliseconds it took Elasticsearch to execute the request.

timed_out boolean

If true, the request timed out before completion.

hits object required

Contains matching events and sequences. Also contains related metadata.

total object

Metadata about the number of matching events or sequences.

relation enum required

Supported values include:

  • eq: Accurate
  • gte: Lower bound, including returned events or sequences
Values: eq gte
value number required
events object[]

Contains events matching the query. Each object represents a matching event.

_index string required

Name of the index containing the event.

_id string required

Unique identifier for the event. This ID is only unique within the index.

_source object required

Original JSON body passed for the event at index time.

missing boolean

Set to true for events in a timespan-constrained sequence that do not meet a given condition.

fields map string to object
sequences object[]

Contains event sequences matching the query. Each object represents a matching sequence. This parameter is only returned for EQL queries containing a sequence.

events object[] required

Contains events matching the query. Each object represents a matching event.

_index string required

Name of the index containing the event.

_id string required

Unique identifier for the event. This ID is only unique within the index.

_source object required

Original JSON body passed for the event at index time.

missing boolean

Set to true for events in a timespan-constrained sequence that do not meet a given condition.

fields map string to object
join_keys object[]

Shared field values used to constrain matches in the sequence. These are defined using the by keyword in the EQL query syntax.

shard_failures object[]

Contains information about shard failures (if any), in case allow_partial_search_results=true

index string
node string
reason object required
type string required

The type of error

reason union string nullable

A human-readable explanation of the error, in English.

One of: string
stack_trace string

The server stack trace. Present only if the error_trace=true parameter was sent with the request.

caused_by object
Same fields as reason in shard_failures
root_cause object[]
Same fields as reason in shard_failures
suppressed object[]
Same fields as reason in shard_failures
shard number
status string
primary boolean