Create or update a watch
- POST also PUT /_watcher/watch/{id}
When a watch is registered, a new document that represents the watch is added to the .watches index and its trigger is immediately registered with the relevant trigger engine.
Typically for the schedule trigger, the scheduler is the trigger engine.
You must use Kibana or this API to create a watch.
Do not add a watch directly to the .watches index by using the Elasticsearch index API.
If Elasticsearch security features are enabled, do not give users write privileges on the .watches index.
When you add a watch you can also define its initial active state by setting the active parameter.
When Elasticsearch security features are enabled, your watch can index or search only on indices for which the user that stored the watch has privileges.
If the user is able to read index a, but not index b, the same will apply when the watch runs.
Required privileges
- Cluster privileges manage_watcher
Query parameters
Request body
-
actionsmap string to object -
The list of actions that will be run if the condition matches.
-
<string>object -
conditionobject -
comparemap string to string to oneOf · min properties: 1 · max properties: 1 -
<string>map string to oneOf · min properties: 1 · max properties: 1 -
scriptobject -
langunion anyOf · default: painless -
Supported values include:
painless: Painless scripting language, purpose-built for Elasticsearch.expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.mustache: Mustache templated, used for templates.java: Expert Java API
-
Values:
painlessexpressionmustachejava -
sourceunion oneOf - One of:
-
aggregationsmap string to {} Aggregation -
Defines the aggregations that are run as part of the search request.
-
collapseobject -
Collapses search results the values of the specified field.
-
inner_hitsunion oneOf -
The number of inner hits and their sort order
-
objectorobject[] -
namestring -
The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits.
-
collapseobject -
Same fields as
collapseinSearchRequestBody -
highlightobject -
typeunion anyOf -
Supported values include:
plain: Theplainhighlighter uses the standard Lucene highlighterfvh: The fvh highlighter uses the Lucene Fast Vector highlighter.unified: The unified highlighter uses the Lucene Unified Highlighter.
-
Values:
plainfvhunified -
boundary_scannerenum -
Specifies how to break the highlighted fragments: chars, sentence, or word. Only valid for the unified and fvh highlighters. Defaults to
sentencefor theunifiedhighlighter. Defaults tocharsfor thefvhhighlighter.Supported values include:
chars: Use the characters specified byboundary_charsas highlighting boundaries. Theboundary_max_scansetting controls how far to scan for boundary characters. Only valid for thefvhhighlighter.sentence: Break highlighted fragments at the next sentence boundary, as determined by Java’sBreakIterator. You can specify the locale to use withboundary_scanner_locale. When used with theunifiedhighlighter, thesentencescanner splits sentences bigger thanfragment_sizeat the first word boundary next to fragment_size. You can setfragment_sizeto0to never split any sentence.word: Break highlighted fragments at the next word boundary, as determined by Java’sBreakIterator. You can specify the locale to use withboundary_scanner_locale.
-
Values:
charssentenceword -
boundary_scanner_localestring · default: Locale.ROOT -
Controls which locale is used to search for sentence and word boundaries. This parameter takes a form of a language tag, for example:
"en-US","fr-FR","ja-JP". -
fragmenterenum · default: span -
Specifies how text should be broken up in highlight snippets:
simpleorspan. Only valid for theplainhighlighter. -
Values:
simplespan -
highlight_query{} Query -
Highlight matches for a query other than the search query. This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.
-
max_analyzed_offsetnumber -
If set to a non-negative value, highlighting stops at this defined maximum limit. The rest of the text is not processed, thus not highlighted and no error is returned The
max_analyzed_offsetquery setting does not override theindex.highlight.max_analyzed_offsetsetting, which prevails when it’s set to lower value than the query setting. -
no_match_sizenumber · default: 0 -
The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight.
-
number_of_fragmentsnumber · default: 5 -
The maximum number of fragments to return. If the number of fragments is set to
0, no fragments are returned. Instead, the entire field contents are highlighted and returned. This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required. Ifnumber_of_fragmentsis0,fragment_sizeis ignored. -
orderenum · default: none -
Sorts highlighted fragments by score when set to
score. By default, fragments will be output in the order they appear in the field (order:none). Setting this option toscorewill output the most relevant fragments first. Each highlighter applies its own logic to compute relevancy scores. -
Values:
score -
phrase_limitnumber · default: 256 -
Controls the number of matching phrases in a document that are considered. Prevents the
fvhhighlighter from analyzing too many phrases and consuming too much memory. When usingmatched_fields,phrase_limitphrases per matched field are considered. Raising the limit increases query time and consumes more memory. Only supported by thefvhhighlighter. -
post_tagsstring[] -
Use in conjunction with
pre_tagsto define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in<em>and</em>tags. -
pre_tagsstring[] -
Use in conjunction with
post_tagsto define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in<em>and</em>tags. -
sortunion oneOf -
How the inner hits should be sorted per
inner_hits. By default, inner hits are sorted by score. -
_sourceunion oneOf - One of:
-
explainboolean · default: false -
If
true, the request returns detailed information about score computation as part of a hit. -
fromnumber · default: 0 -
The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. -
highlightobject -
Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
-
Same fields as
highlightininner_hits - Reference
-
track_total_hitsboolean | number · default: 10000 -
Number of hits matching the query to count accurately. If
true, the exact number of hits is returned at the cost of some performance. Iffalse, the response does not include the total number of hits matching the query. -
indices_booststring to number[] -
Boost the
_scoreof documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than1.0increases the score. A boost value between0and1.0decreases the score. - Reference
-
docvalue_fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns doc values for field names matching these patterns in thehits.fieldsproperty of the response. - Reference
-
knnunion oneOfThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The approximate kNN search to run.
-
objectorobject[] - Reference
-
query_vector_builderobject -
The query vector builder. You must provide a query_vector_builder or query_vector, but not both.
-
text_embeddingobject -
model_idstringThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.18 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Model ID is required for all dense_vector fields but may be inferred for semantic_text fields
-
lookupobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Lookup a vector from an existing document. Must reference a dense_vector field and a single value.
-
visit_percentagenumberThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The percentage of vectors to explore per shard while doing knn search with bbq_disk
-
inner_hitsobject -
If defined, each search hit will contain inner hits.
- Reference
-
namestring -
The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits.
-
highlightobject -
Same fields as
highlightininner_hits -
sortunion oneOf -
How the inner hits should be sorted per
inner_hits. By default, inner hits are sorted by score. -
Same options as
sortininner_hits -
_sourceunion oneOf - One of:
-
rescore_vectorobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.18 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Apply oversampling and rescoring to quantized vectors
-
rankobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.8 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The Reciprocal Rank Fusion (RRF) to use.
-
min_scorenumber -
The minimum
_scorefor matching documents. Documents with a lower_scoreare not included in search results or results collected by aggregations. -
post_filter{} Query -
Use the
post_filterparameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results. -
profileboolean · default: false -
Set to
trueto return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. - Reference
-
query{} Query -
The search definition using the Query DSL.
-
rescoreunion oneOf -
Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the
queryandpost_filterphases. -
objectorobject[] - Reference
-
queryobject -
rescore_query{} Queryrequired -
The query to use for rescoring. This query is only run on the Top-K results returned by the
queryandpost_filterphases. -
query_weightnumber · default: 1 -
Relative importance of the original query versus the rescore query.
-
rescore_query_weightnumber · default: 1 -
Relative importance of the rescore query versus the original query.
-
score_modeenum · default: total -
Determines how scores are combined.
Supported values include:
avg: Average the original score and the rescore query score.max: Take the max of original score and the rescore query score.min: Take the min of the original score and the rescore query score.multiply: Multiply the original score by the rescore query score. Useful forfunctionquery rescores.total: Add the original score and the rescore query score.
-
Values:
avgmaxminmultiplytotal -
retrieverobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.14 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as
queryandknn. - Reference
-
standardobject -
A retriever that replaces the functionality of a traditional query.
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
query{} Query -
Defines a query to retrieve a set of top documents.
-
sortunion oneOf -
A sort object that that specifies the order of matching documents.
-
Same options as
sortininner_hits -
collapseobject -
Collapses the top documents by a specified key into a single top document per key.
-
Same fields as
collapseinSearchRequestBody -
knnobject -
A retriever that replaces the functionality of a knn search.
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
query_vectorunion oneOf -
Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both.
-
One of:
number[]orstring -
query_vector_builderobject -
Defines a model to build a query vector.
-
Same fields as
query_vector_builderinknn -
visit_percentagenumberThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The percentage of vectors to explore per shard while doing knn search with bbq_disk
-
rescore_vectorobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.18 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Apply oversampling and rescoring to quantized vectors
-
rrfobject -
A retriever that produces top documents from reciprocal rank fusion (RRF).
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
retrieversunion oneOf[]required -
A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter.
- One of:
-
text_similarity_rerankerobject -
A retriever that reranks the top documents based on a reranking model using the InferenceAPI
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
retrieverobjectrequired -
The nested retriever which will produce the first-level results, that will later be used for reranking.
-
Same fields as
retrieverinSearchRequestBody -
rank_window_sizenumber -
This value determines how many documents we will consider from the nested retriever.
-
fieldstringrequired -
The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text.
-
chunk_rescorerobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
Whether to rescore on only the best matching chunks.
-
chunking_settingsobject -
Chunking settings to apply
-
max_chunk_sizenumber · default: 250required -
The maximum size of a chunk in words. This value cannot be lower than
20(forsentencestrategy) or10(forwordstrategy). This value should not exceed the window size for the associated model. -
overlapnumber · default: 100 -
The number of overlapping words for chunks. It is applicable only to a
wordchunking strategy. This value cannot be higher than half themax_chunk_sizevalue. -
sentence_overlapnumber · default: 1 -
The number of overlapping sentences for chunks. It is applicable only for a
sentencechunking strategy. It can be either1or0. -
separator_groupstring -
Only applicable to the
recursivestrategy and required when using it.Sets a predefined list of separators in the saved chunking settings based on the selected text type. Values can be
markdownorplaintext.Using this parameter is an alternative to manually specifying a custom
separatorslist. -
separatorsstring[] -
Only applicable to the
recursivestrategy and required when using it.A list of strings used as possible split points when chunking text.
Each string can be a plain string or a regular expression (regex) pattern. The system tries each separator in order to split the text, starting from the first item in the list.
After splitting, it attempts to recombine smaller pieces into larger chunks that stay within the
max_chunk_sizelimit, to reduce the total number of chunks generated. -
strategystring · default: sentence -
The chunking strategy:
sentence,word,noneorrecursive.- If
strategyis set torecursive, you must also specify:
max_chunk_size- either
separatorsorseparator_group
Learn more about different chunking strategies in the linked documentation.
- If
- Reference
-
ruleobject -
A retriever that replaces the functionality of a rule query.
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
ruleset_idsunion string | string[]required -
The ruleset IDs containing the rules this retriever is evaluating against.
-
match_criteriaobjectrequired -
The match criteria that will determine if a rule in the provided rulesets should be applied.
-
retrieverobjectrequired -
The retriever whose results rules should be applied to.
-
Same fields as
retrieverinSearchRequestBody -
linearobject -
A retriever that supports the combination of different retrievers through a weighted linear combination.
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
retrieversobject[] -
Inner retrievers.
-
retrieverobjectrequired -
The nested retriever configuration.
-
Same fields as
retrieverinSearchRequestBody -
pinnedobject -
A pinned retriever applies pinned documents to the underlying retriever. This retriever will rewrite to a PinnedQueryBuilder.
-
diversifyobject -
A retriever that diversifies the results from its child retriever.
-
min_scorenumber -
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
-
retrieverobjectrequired -
The nested retriever whose results will be diversified.
-
Same fields as
retrieverinSearchRequestBody -
rank_window_sizenumber -
The number of top documents from the nested retriever to consider for diversification.
-
query_vector_builderobject -
a dense vector query vector builder to use instead of a static query_vector
-
Same fields as
query_vector_builderinknn -
script_fieldsmap string to object -
Retrieve a script evaluation (based on different fields) for each hit.
-
search_afterunion[] -
Used to retrieve the next page of hits using a set of sort values from the previous page.
- Reference
-
sizenumber · default: 10 -
The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterproperty. -
sliceobject -
Split a scrolled search into multiple slices that can be consumed independently.
- Reference
-
_sourceunion oneOf -
The source fields that are returned for matching documents. These fields are returned in the
hits._sourceproperty of the search response. If thestored_fieldsproperty is specified, the_sourceproperty defaults tofalse. Otherwise, it defaults totrue. - One of:
- Reference
-
fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns values for field names matching these patterns in thehits.fieldsproperty of the response. -
suggestobject -
Defines a suggester that provides similar looking terms based on a provided text.
- Reference
-
terminate_afternumber · default: 0 -
The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.
ImportantUse with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to
0(default), the query does not terminate early. -
timeoutstring -
The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
-
track_scoresboolean · default: false -
If
true, calculate and return document scores, even if the scores are not used for sorting. -
versionboolean · default: false -
If
true, the request returns the document version as part of a hit. -
seq_no_primary_termboolean -
If
true, the request returns sequence number and primary term of the last modification of each hit. - Reference
-
stored_fieldsunion oneOf -
A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the
_sourceproperty defaults tofalse. You can pass_source: trueto return both source fields and stored fields in the search response. -
One of:
string[]orstring - Reference
-
pitobject -
Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an
<index>in the request path. -
runtime_mappingsobject -
One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
- Reference
-
transformobject -
chainobject[] -
Same fields as
transforminactions -
scriptobject -
sourceunion oneOf - One of:
-
aggregationsmap string to {} Aggregation -
Defines the aggregations that are run as part of the search request.
-
collapseobject -
Collapses search results the values of the specified field.
-
Same fields as
collapseinSearchRequestBody -
explainboolean · default: false -
If
true, the request returns detailed information about score computation as part of a hit. -
fromnumber · default: 0 -
The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. -
highlightobject -
Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
-
Same fields as
highlightininner_hits - Reference
-
track_total_hitsboolean | number · default: 10000 -
Number of hits matching the query to count accurately. If
true, the exact number of hits is returned at the cost of some performance. Iffalse, the response does not include the total number of hits matching the query. -
indices_booststring to number[] -
Boost the
_scoreof documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than1.0increases the score. A boost value between0and1.0decreases the score. - Reference
-
docvalue_fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns doc values for field names matching these patterns in thehits.fieldsproperty of the response. - Reference
-
knnunion oneOfThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The approximate kNN search to run.
-
objectorobject[] -
Same options as
knninSearchRequestBody - Reference
-
rankobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.8 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The Reciprocal Rank Fusion (RRF) to use.
-
min_scorenumber -
The minimum
_scorefor matching documents. Documents with a lower_scoreare not included in search results or results collected by aggregations. -
post_filter{} Query -
Use the
post_filterparameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results. -
profileboolean · default: false -
Set to
trueto return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. - Reference
-
query{} Query -
The search definition using the Query DSL.
-
rescoreunion oneOf -
Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the
queryandpost_filterphases. -
objectorobject[] -
Same options as
rescoreinSearchRequestBody - Reference
-
retrieverobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.14 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as
queryandknn. -
Same fields as
retrieverinSearchRequestBody - Reference
-
script_fieldsmap string to object -
Retrieve a script evaluation (based on different fields) for each hit.
-
search_afterunion[] -
Used to retrieve the next page of hits using a set of sort values from the previous page.
- Reference
-
sizenumber · default: 10 -
The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterproperty. -
sliceobject -
Split a scrolled search into multiple slices that can be consumed independently.
- Reference
-
_sourceunion oneOf -
The source fields that are returned for matching documents. These fields are returned in the
hits._sourceproperty of the search response. If thestored_fieldsproperty is specified, the_sourceproperty defaults tofalse. Otherwise, it defaults totrue. - One of:
- Reference
-
fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns values for field names matching these patterns in thehits.fieldsproperty of the response. -
suggestobject -
Defines a suggester that provides similar looking terms based on a provided text.
- Reference
-
terminate_afternumber · default: 0 -
The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.
ImportantUse with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to
0(default), the query does not terminate early. -
timeoutstring -
The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
-
track_scoresboolean · default: false -
If
true, calculate and return document scores, even if the scores are not used for sorting. -
versionboolean · default: false -
If
true, the request returns the document version as part of a hit. -
seq_no_primary_termboolean -
If
true, the request returns sequence number and primary term of the last modification of each hit. - Reference
-
stored_fieldsunion oneOf -
A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the
_sourceproperty defaults tofalse. You can pass_source: trueto return both source fields and stored fields in the search response. -
One of:
string[]orstring - Reference
-
pitobject -
Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an
<index>in the request path. -
runtime_mappingsobject -
One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
- Reference
-
searchobject -
requestobjectrequired -
bodyobject -
aggregationsmap string to {} Aggregation -
Defines the aggregations that are run as part of the search request.
-
collapseobject -
Collapses search results the values of the specified field.
-
Same fields as
collapseinSearchRequestBody -
explainboolean · default: false -
If
true, the request returns detailed information about score computation as part of a hit. -
fromnumber · default: 0 -
The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. -
highlightobject -
Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
-
Same fields as
highlightininner_hits - Reference
-
track_total_hitsboolean | number · default: 10000 -
Number of hits matching the query to count accurately. If
true, the exact number of hits is returned at the cost of some performance. Iffalse, the response does not include the total number of hits matching the query. -
indices_booststring to number[] -
Boost the
_scoreof documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than1.0increases the score. A boost value between0and1.0decreases the score. - Reference
-
docvalue_fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns doc values for field names matching these patterns in thehits.fieldsproperty of the response. - Reference
-
knnunion oneOfThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The approximate kNN search to run.
-
objectorobject[] -
Same options as
knninSearchRequestBody - Reference
-
rankobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.8 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
The Reciprocal Rank Fusion (RRF) to use.
-
min_scorenumber -
The minimum
_scorefor matching documents. Documents with a lower_scoreare not included in search results or results collected by aggregations. -
post_filter{} Query -
Use the
post_filterparameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results. -
profileboolean · default: false -
Set to
trueto return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. - Reference
-
query{} Query -
The search definition using the Query DSL.
-
rescoreunion oneOf -
Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the
queryandpost_filterphases. -
objectorobject[] -
Same options as
rescoreinSearchRequestBody - Reference
-
retrieverobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.14 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as
queryandknn. -
Same fields as
retrieverinSearchRequestBody - Reference
-
script_fieldsmap string to object -
Retrieve a script evaluation (based on different fields) for each hit.
-
search_afterunion[] -
Used to retrieve the next page of hits using a set of sort values from the previous page.
- Reference
-
sizenumber · default: 10 -
The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterproperty. -
sliceobject -
Split a scrolled search into multiple slices that can be consumed independently.
- Reference
-
_sourceunion oneOf -
The source fields that are returned for matching documents. These fields are returned in the
hits._sourceproperty of the search response. If thestored_fieldsproperty is specified, the_sourceproperty defaults tofalse. Otherwise, it defaults totrue. - One of:
- Reference
-
fieldsobject[] -
An array of wildcard (
*) field patterns. The request returns values for field names matching these patterns in thehits.fieldsproperty of the response. -
suggestobject -
Defines a suggester that provides similar looking terms based on a provided text.
- Reference
-
terminate_afternumber · default: 0 -
The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.
ImportantUse with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to
0(default), the query does not terminate early. -
timeoutstring -
The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
-
track_scoresboolean · default: false -
If
true, calculate and return document scores, even if the scores are not used for sorting. -
versionboolean · default: false -
If
true, the request returns the document version as part of a hit. -
seq_no_primary_termboolean -
If
true, the request returns sequence number and primary term of the last modification of each hit. - Reference
-
stored_fieldsunion oneOf -
A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the
_sourceproperty defaults tofalse. You can pass_source: trueto return both source fields and stored fields in the search response. -
One of:
string[]orstring - Reference
-
pitobject -
Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an
<index>in the request path. -
runtime_mappingsobject -
One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
- Reference
-
indices_optionsobject -
allow_no_indicesboolean -
A setting that does two separate checks on the index expression. If
false, the request returns an error (1) if any wildcard expression (including_alland*) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. Iftrue, index expressions that resolve to no indices are allowed and the request returns an empty result. -
expand_wildcardsunion oneOf -
Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as
open,hidden.Supported values include:
all: Match any data stream or index, including hidden ones.open: Match open, non-hidden indices. Also matches any non-hidden data stream.closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.hidden: Match hidden data streams and hidden indices. Must be combined withopen,closed, orboth.none: Wildcard expressions are not accepted.
-
Values:
allopenclosedhiddennone -
search_typeenum -
Supported values include:
query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
-
Values:
query_then_fetchdfs_query_then_fetch -
templateobject -
langunion anyOf · default: mustache -
The language the template is written in. It is reported in the resolved search input of a watch record.
Supported values include:
painless: Painless scripting language, purpose-built for Elasticsearch.expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.mustache: Mustache templated, used for templates.java: Expert Java API
-
Values:
painlessexpressionmustachejava -
emailobject -
slackobject -
messageobjectrequired -
dynamic_attachmentsobject -
attachment_templateobjectrequired -
Same fields as
attachmentsinmessage -
webhookobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 7.14 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. -
conditionobject -
The condition that defines if the actions should be run.
-
comparemap string to string to oneOf · min properties: 1 · max properties: 1 -
<string>map string to oneOf · min properties: 1 · max properties: 1 -
scriptobject -
langunion anyOf · default: painless -
Supported values include:
painless: Painless scripting language, purpose-built for Elasticsearch.expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.mustache: Mustache templated, used for templates.java: Expert Java API
-
Values:
painlessexpressionmustachejava -
sourceunion oneOf -
Same options as
sourceinscript -
throttle_periodunion oneOf -
The minimum time between actions being run. The default is 5 seconds. This default can be changed in the config file with the setting
xpack.watcher.throttle.period.default_period. If both this value and thethrottle_period_in_millisparameter are specified, Watcher uses the last parameter included in the request. -
Values:
-10 -
throttle_period_in_millisnumber -
Minimum time in milliseconds between actions being run. Defaults to 5000. If both this value and the throttle_period parameter are specified, Watcher uses the last parameter included in the request.
-
transformobject -
The transform that processes the watch payload to prepare it for the watch actions.
-
Same fields as
transforminactions