stack kb saved-objects get-saved-objects-find cli command

elastic stack kb saved-objects get-saved-objects-find --type <type> [options]

Search for saved objects

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--type string[] required

The saved object type or types to search for. Use multiple type values to search across types.

Repeatable: pass --type multiple times to supply more than one value

--per-page number

The number of items per page.

--page number

The page index to return.

--search string

A text search string.

--default-search-operator enum

The boolean operator to use when combining multiple values.

Values: OR, AND

--search-fields string[]

The fields to search on.

Repeatable: pass --search-fields multiple times to supply more than one value

--sort-field string

The field to sort on.

--has-reference string

Return only saved objects that have a reference to the specified saved object(s).

Repeatable: pass --has-reference multiple times to supply more than one value

--has-reference-operator enum

The boolean operator to use when combining multiple values.

Values: OR, AND

--has-no-reference string

Return only saved objects that do not have a reference to the specified saved object(s).

Repeatable: pass --has-no-reference multiple times to supply more than one value

--has-no-reference-operator enum

The boolean operator to use when combining multiple values.

Values: OR, AND

--fields string[]

The fields to return for each saved object.

Repeatable: pass --fields multiple times to supply more than one value

--filter string

A KQL filter to apply to the search.

--aggs string

Aggregations as a JSON string.

--namespaces string[]

The namespaces (spaces) to search in.

Repeatable: pass --namespaces multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON