Get async EQL search results

GET /_eql/search/{id}

Auth

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

Path parameters

id string required: Identifier for the search.

Query parameters

keep_alive union oneOf · default: 5d: Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.; Values: -1 0
wait_for_completion_timeout union oneOf: Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.; Values: -1 0; Reference

Response

application/json

id string: Identifier for the search.
is_partial boolean: If true, the response does not contain complete search results.
is_running boolean: If true, the search request is still executing.
took number: Milliseconds it took Elasticsearch to execute the request.
timed_out boolean: If true, the request timed out before completion.
hits object required: Contains matching events and sequences. Also contains related metadata.
shard_failures object[]: Contains information about shard failures (if any), in case allow_partial_search_results=true

View as Markdown

Examples

Request Console 1 / 8 languages

Console Kibana Dev Tools

GET /_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s

JavaScript Elasticsearch JavaScript Client

const response = await client.eql.get({
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s",
});

Python Elasticsearch Python Client

resp = client.eql.get(
    id="FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    wait_for_completion_timeout="2s",
)

curl Shell

curl -X GET "$ELASTICSEARCH_URL/_eql/search/FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=?wait_for_completion_timeout=2s" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"

Java Elasticsearch Java Client

client.eql().get(g -> g
    .id("FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=")
    .waitForCompletionTimeout(w -> w
        .offset(2)
    )
);

C# Elasticsearch .NET Client

var response = await client.Eql
    .GetAsync<MyDocument>(id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=", d1 => d1
        .WaitForCompletionTimeout("2s")
    );

PHP Elasticsearch PHP Client

$resp = $client->eql()->get([
    "id" => "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
    "wait_for_completion_timeout" => "2s",
]);

Ruby Elasticsearch Ruby Client

response = client.eql.get(
  id: "FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=",
  wait_for_completion_timeout: "2s"
)

Response

{
  "id": "string",
  "is_partial": false,
  "is_running": false,
  "took": 0,
  "timed_out": false,
  "hits": {
    "total": {
      "relation": "eq",
      "value": 0
    },
    "events": [
      {
        "_index": "string",
        "_id": "string",
        "_source": {},
        "missing": false,
        "fields": {
          "key": []
        }
      }
    ],
    "sequences": [
      {
        "events": [
          {
            "missing": false
          }
        ],
        "join_keys": [
          {}
        ]
      }
    ]
  },
  "shard_failures": [
    {
      "index": "string",
      "node": "string",
      "reason": {
        "type": "string",
        "reason": "string",
        "stack_trace": "string",
        "caused_by": {
          "type": "string",
          "reason": "string",
          "stack_trace": "string",
          "caused_by": {
            "type": "string",
            "stack_trace": "string"
          },
          "root_cause": [],
          "suppressed": []
        },
        "root_cause": [
          {
            "type": "string",
            "stack_trace": "string"
          }
        ],
        "suppressed": [
          {
            "type": "string",
            "stack_trace": "string"
          }
        ]
      },
      "shard": 0,
      "status": "string",
      "primary": false
    }
  ]
}

Generated from the API spec