Type to search.

Run a Fleet search

  • POST also GET /{index}/_fleet/_fleet_search
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental since 7.16 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The purpose of the Fleet search API is to provide an API where the search will be run only after the provided checkpoint has been processed and is visible for searches inside of Elasticsearch.

Required privileges

Index privileges read

Path parameters

index union string required

A single target to search. If the target is an index alias, it must resolve to a single index.

Query parameters

allow_no_indices boolean

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

analyzer string
analyze_wildcard boolean
batched_reduce_size number
ccs_minimize_roundtrips boolean
default_operator enum
Values: and AND or OR
df string
docvalue_fields union string | string[]
expand_wildcards union enum | enum[]

Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
Values: all open closed hidden none
explain boolean
ignore_throttled boolean
ignore_unavailable boolean

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

lenient boolean
max_concurrent_shard_requests number
preference string
pre_filter_shard_size number
request_cache boolean
routing union string | string[]

A custom value used to route operations to a specific shard. Not allowed when index.slice.enabled is true for the target index; use _slice instead.

scroll string
search_type enum

Supported values include:

  • query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.
  • dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
Values: query_then_fetch dfs_query_then_fetch
stats string[]
stored_fields union string | string[]
suggest_field string

Specifies which field to use for suggestions.

suggest_mode enum

Supported values include:

  • missing: Only generate suggestions for terms that are not in the shard.
  • popular: Only suggest terms that occur in more docs on the shard than the original term.
  • always: Suggest any matching suggestions based on terms in the suggest text.
Values: missing popular always
suggest_size number
suggest_text string

The source text for which the suggestions should be returned.

terminate_after number
timeout string
track_total_hits boolean | number
track_scores boolean
typed_keys boolean
rest_total_hits_as_int boolean
version boolean
_source union oneOf
One of: boolean or string
_source_excludes union string | string[]
_source_includes union string | string[]
seq_no_primary_term boolean
q string
size number
from number
sort union string | string[]
wait_for_checkpoints number[] · default: []

A comma separated list of checkpoints. When configured, the search API will only be executed on a shard after the relevant checkpoint has become visible for search. Defaults to an empty list which will cause Elasticsearch to immediately execute the search.

allow_partial_search_results boolean

If true, returns partial results if there are shard request timeouts or shard failures. If false, returns an error with no partial results. Defaults to the configured cluster setting search.default_allow_partial_results, which is true by default.

Request body

aggregations map string to {} Aggregation
explain boolean · default: false

If true, returns detailed information about score computation as part of a hit.

ext map string to object

Configuration of search extensions defined by Elasticsearch plugins.

from number · default: 0

Starting document offset. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

highlight object
Same fields as highlight in inner_hits
track_total_hits boolean | number

Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.

indices_boost string to number[]

Boosts the _score of documents from specified indices.

min_score number

Minimum _score for matching documents. Documents with a lower _score are not included in search results and results collected by aggregations.

post_filter {} Query
profile boolean
query {} Query

Defines the search definition using the Query DSL.

script_fields map string to object

Retrieve a script evaluation (based on different fields) for each hit.

search_after union[]
size number · default: 10

The number of hits to return. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

sort union oneOf
Same options as sort in inner_hits
_source union oneOf

Indicates which source fields are returned for matching documents. These fields are returned in the hits._source property of the search response.

One of:
terminate_after number · default: 0

Maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. Defaults to 0, which does not terminate query execution early.

timeout string

Specifies the period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.

track_scores boolean · default: false

If true, calculate and return document scores, even if the scores are not used for sorting.

version boolean · default: false

If true, returns document version as part of a hit.

seq_no_primary_term boolean

If true, returns sequence number and primary term of the last modification of each hit. See Optimistic concurrency control.

stored_fields union oneOf

List of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the _source parameter defaults to false. You can pass _source: true to return both source fields and stored fields in the search response.

One of: string[] or string
runtime_mappings object

Defines one or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.

stats string[]

Stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.

Response

application/json
took number required
timed_out boolean required
_shards object required
failed number required

The number of shards the operation or search attempted to run on but failed.

successful number required

The number of shards the operation or search succeeded on.

total number required

The number of shards the operation or search will run on overall.

skipped number
hits object required
total union oneOf

Total hit count information, present only if track_total_hits wasn't false in the search request.

One of:
relation enum required

Supported values include:

  • eq: Accurate
  • gte: Lower bound, including returned events or sequences
Values: eq gte
value number required
hits object[] required
_index string required
_id string
_score union number | string nullable
fields map string to object
highlight map string to string
inner_hits map string to object
matched_queries union oneOf
One of: string[] or string to number
_ignored string[]
ignored_field_values map string to object
_shard string
_node string
_routing string
_source object
_rank number
_seq_no number
_primary_term number
_version number
sort union[]
max_score union number | string nullable
aggregations map string to {} Aggregation result
fields map string to object
max_score number
num_reduce_phases number
pit_id string
_scroll_id string
suggest map string to oneOf
terminated_early boolean