IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« EQL search API Delete async EQL search API »
Elastic Docs ›Elasticsearch Guide [7.10] ›REST APIs ›Search APIs

Get async EQL search API

edit

Get async EQL search API

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

Returns the current status and available results for an async EQL search or a stored synchronous EQL search.

GET /_eql/search/FkpMRkJGS1gzVDRlM3g4ZzMyRGlLbkEaTXlJZHdNT09TU2VTZVBoNDM3cFZMUToxMDM=

Request

edit

GET /_eql/search/<search_id>

Prerequisites

edit
  • If the Elasticsearch security features are enabled, only the user who first submitted the EQL search can retrieve the search using this API.
  • See Required fields.

Limitations

edit

See EQL limitations.

Path parameters

edit
<search_id>

(Required, string) Identifier for the search.

A search ID is provided in the EQL search API's response for an async search. A search ID is also provided if the request’s keep_on_completion parameter is true.

Query parameters

edit
keep_alive

(Optional, time value) Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.

If specified, this parameter sets a new keep_alive period for the search, starting when the get async EQL search API request executes. This new period overwrites the one specified in the EQL search API request.

When this period expires, the search and its results are deleted, even if the search is ongoing.

wait_for_completion_timeout

(Optional, time value) Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.

If this parameter is specified and the request completes during this period, complete search results are returned.

If the request does not complete during this period, the response returns an is_partial value of true and no search results.

Response body

edit

The async EQL search API returns the same response body as the EQL search API. See the EQL search API’s response body parameters.

« EQL search API Delete async EQL search API »