Returns results matching a query expressed in Event Query Language (EQL) Added in 7.9.0
Path parameters
-
The name of the index to scope the operation
Query parameters
-
allow_no_indices boolean
-
expand_wildcards string | array[string]
-
keep_alive string
Period for which the search and its results are stored on the cluster.
-
keep_on_completion boolean
If true, the search and its results are stored on the cluster.
-
wait_for_completion_timeout string
Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.
Body Required
-
EQL query you wish to run.
-
case_sensitive boolean
-
event_category_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
tiebreaker_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
timestamp_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
fetch_size number
-
keep_alive string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
keep_on_completion boolean
-
wait_for_completion_timeout string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
size number
fields object | array[object]
Array of wildcard (*) patterns. The response returns values for field names matching these patterns in the fields property of each hit.
-
result_position string
Values are
tail
orhead
. -
runtime_mappings object
curl \
-X POST http://api.example.com/{index}/_eql/search \
-H "Content-Type: application/json" \
-d '"{\n \"query\": \"\"\"\n process where process.name == \"regsvr32.exe\"\n \"\"\"\n}"'
{
"query": """
process where process.name == "regsvr32.exe"
"""
}
{
"query": """
process where (process.name == "cmd.exe" and process.pid != 2013)
"""
}
{
"id": "string",
"is_partial": true,
"is_running": true,
"": 42.0,
"timed_out": true,
"hits": {
"total": {
"relation": "eq",
"value": 42.0
},
"events": [
{
"_index": "string",
"_id": "string",
"_source": {},
"missing": true,
"fields": {
"additionalProperty1": [
{}
],
"additionalProperty2": [
{}
]
}
}
],
"sequences": [
{
"events": [
{
"_index": "string",
"_id": "string",
"_source": {},
"missing": true,
"fields": {}
}
],
"join_keys": [
{}
]
}
]
}
}