Query AI Indices

Base URL
https://{kibana_url}
  • POST /api/context_engine/ai_index/_query
  • POST /s/{space_id}/api/context_engine/ai_index/_query
Auth

Runs an ES|QL query as the current user. The server applies a space filter and limits the response to at most 1000 rows.

The query determines which indices it reads. Elasticsearch index privileges limit which indices the current user can access.

The space comes from the request URL (/s/{spaceId}/…) or defaults to the default space. The request body cannot change the space or replace the space filter.

Returns a 404 response when Context Engine is turned off in this space (contextEngine:enabled).

For more information, refer to the Context Engine documentation.

Required authorization

Privileges contextEngine:read

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

limit number · min: 1 · max: 1000

Maximum rows to return. Defaults to 100; a trailing LIMIT in the query is capped to this value.

params map string to string | number | boolean

Values for ?name placeholders in the query.

query string · min length: 1 · max length: 10000 required

The ES|QL query to run. Its FROM decides which Elasticsearch indices are read (normally ai-index-*); the server adds the space filter and a row limit.

Responses

The columns and rows returned by the ES|QL query.

application/json
columns object[] required

Column metadata for the returned rows.

name string required

Column name.

type string required

Column ES|QL type.

values object[] required

Row values, aligned positionally with columns, as Elasticsearch returns them. A multi-valued field is an array; _source and flattened columns are objects.

The ES|QL query was invalid, or its response exceeded the size limit.

application/json
error string

The HTTP status text.

message string required

A human-readable error message.

statusCode number

The HTTP status code.

Elasticsearch rejected the read; the caller lacks index privileges.

application/json
error string

The HTTP status text.

message string required

A human-readable error message.

statusCode number

The HTTP status code.

Context Engine is turned off in this space.

application/json
error string

The HTTP status text.

message string required

A human-readable error message.

statusCode number

The HTTP status code.

Base URL
https://{kibana_url}