Type to search.

Query AI Indices

Base URL
https://{kibana_url}
  • POST /api/context_engine/ai_index/_query
  • POST /s/{space_id}/api/context_engine/ai_index/_query
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Runs an ES|QL query as the current user. The server applies a space filter and limits the response to at most 1000 rows.

The query determines which indices it reads. Elasticsearch index privileges limit which indices the current user can access.

The space comes from the request URL (/s/{spaceId}/…) or defaults to the default space. The request body cannot change the space or replace the space filter.

Returns a 404 response when Context Engine is turned off in this space (contextEngine:enabled).

For more information, refer to the Context Engine documentation.

Required privileges

Privileges contextEngine:read

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

limit number · min: 1 · max: 1000

Maximum rows to return. Defaults to 100; a trailing LIMIT in the query is capped to this value.

params map string to string | number | boolean

Values for ?name placeholders in the query.

query string · min length: 1 · max length: 10000 required

The ES|QL query to run. Its FROM decides which Elasticsearch indices are read (normally ai-index-*); the server adds the space filter and a row limit.

Responses

The columns and rows returned by the ES|QL query.

application/json
columns object[] required

Column metadata for the returned rows.

name string required

Column name.

type string required

Column ES|QL type.

values object[] required

Row values, aligned positionally with columns, as Elasticsearch returns them. A multi-valued field is an array; _source and flattened columns are objects.