Fleet search API
editFleet search API
editThe purpose of the fleet search api is to provide a search api where the search will only be executed after provided checkpoint has been processed and is visible for searches inside of Elasticsearch.
The fleet search API is designed for indirect use through fleet server. Direct use is not supported. Elastic reserves the right to change or remove this feature in future releases without prior notice.
Wait for checkpoint functionality
editThe fleet search API supports the optional parameter wait_for_checkpoints. This parameter
is a list of sequence number checkpoints. When this parameter is present, the search will
only be executed on local shards after the all operations up to and including the provided
sequence number checkpoint are visible for search. Indexed operations become visible after a
refresh. The checkpoints are indexed by shard.
If a timeout occurs before the checkpoint has been refreshed into Elasticsearch, the search request will timeout.
The fleet search API only supports searches against a single target. If an index alias is supplied as the search target, it must resolve to a single concrete index.
Allow partial results
editBy default, the Elasticsearch search api will allow partial search results.
With this fleet API, it is common to configure this to be false or to check in the response
to ensure each shard search was successful. If these precautions are not taken, it is
possible for search results to be successfully returned even if one or more shards
timed out.
Request
editGET /<target>/_fleet/_fleet_search
Path parameters
edit-
<target> - (Required, string) A single target to search. If the target is an index alias, it must resolve to a single index.
Query parameters
edit-
wait_for_checkpoints - (Optional, list) A comma separated list of checkpoints. When configured, the search API will only be executed on a shard after the relevant checkpoint has become visible for search. Defaults to an empty list which will cause Elasticsearch to immediately execute the search.
-
allow_partial_search_results -
(Optional, Boolean)
If
true, returns partial results if there are shard request timeouts or shard failures. Iffalse, returns an error with no partial results. Defaults to the configured cluster settingsearch.default_allow_partial_resultswhich istrueby default.