Type to search.

Get async EQL search results

  • GET /_eql/search/{id}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 7.9 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

Path parameters

id string required

Identifier for the search.

Query parameters

keep_alive string · default: 5d

Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.

wait_for_completion_timeout string

Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.

Reference

Response

application/json
id string

Identifier for the search.

is_partial boolean

If true, the response does not contain complete search results.

is_running boolean

If true, the search request is still executing.

took number

Milliseconds it took Elasticsearch to execute the request.

timed_out boolean

If true, the request timed out before completion.

hits object required

Contains matching events and sequences. Also contains related metadata.