--- title: Elasticsearch v9 slug: connectors/elasticsearch-v9 createdAt: 2026-10-06T11:57:58.267Z --- Elasticsearch v9 is a distributed search and analytics engine used for real-time data processing and retrieval. Elasticsearch v9 is a powerful search and analytics engine that allows users to store, search, and analyze large volumes of data quickly and in near real-time. The connector enables seamless integration with Swimlane Turbine, allowing users to execute complex queries, retrieve search results, and manage asynchronous searches efficiently. This integration empowers security teams to automate data retrieval and analysis, enhancing threat detection and response capabilities within the Swimlane platform. ### Limitations None to date. ### Supported Versions The Elasticsearch connector leverages version 9 APIs. ## Prerequisites Before you can use the Elasticsearch v9 connector for Turbine, you'll need access to the Elasticsearch API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint for your Elasticsearch instance. - Username: Your Elasticsearch username. - Password: Your Elasticsearch password. - API Key authentication using the following parameters: - URL: The endpoint for your Elasticsearch instance. - API Key: A valid API key for accessing Elasticsearch. - HTTP Bearer authentication using the following parameters: - URL: The endpoint for your Elasticsearch instance. - Token: A bearer token such as a JWT for accessing Elasticsearch. ## Capabilities This Connector provides the following capabilities: - Delete an async EQL search - Delete an async ES|QL query - Delete an async search - Get a specific running ES|QL query information - Get an ES|QL view - Get async EQL search results - Get async ES|QL query results - Get async search results - Get EQL search results - Get running ES|QL queries information - Get the async EQL status - Get the async search status - Run a search - Run an async ES|QL query - Run an async search *... and so on* ### Delete an async EQL search Delete an async EQL search or a stored synchronous EQL search. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-delete). ### Delete an async ES|QL query If the query is still running, it is cancelled. Otherwise, the stored results are deleted. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-async-query-delete). ### Delete an async search If the asynchronous search is still running, it is cancelled. Otherwise, the saved search results are deleted. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-async-search-delete). ### Get a specific running ES|QL query information Returns extended information about a running ES|QL query. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-get-query). ### Get an ES|QL view Get the current status and available results or stored results for an ES|QL view. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-get-query-view). ### Get async EQL search results Get the current status and available results for an async EQL search or a stored synchronous EQL search. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-get). ### Get async ES|QL query results Get the current status and available results or stored results for an ES|QL asynchronous query. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-async-query-get). ### Get async search results Retrieve the results of a previously submitted asynchronous search request. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-async-search-get). ### Get EQL search results Returns search results for an Event Query Language (EQL) query. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search). ### Get running ES|QL queries information Returns an object containing IDs and other information about the running ES|QL queries. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-list-queries). ### Get the async EQL status Get the current status for an async EQL search or a stored synchronous EQL search without returning results. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-get-status). ### Get the async search status Get the status of a previously submitted async search request given its identifier, without retrieving search results. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-async-search-status). ### Run a search Get search hits that match the query defined in the request. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-search). ### Run an async ES|QL query Asynchronously run an ES|QL query, monitor its progress, and retrieve results when they become available. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-async-query). ### Run an async search Runs a search asynchronously and returns partial results as shards complete, sorted by the requested indexed field. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-async-search-submit). ### Run an ES|QL query Get search results for an ES|QL query. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-query). ### Stop async ES|QL query Interrupts the query execution and returns the results collected so far. Elasticsearch documentation for this action can be found [here](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-esql-async-query-stop). # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | apikey | API Key for the Elastic Search V8 instance. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username for the HTTP Basic Authentication. | string | Required | | password | Password for the HTTP Basic Authentication. | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | ## HTTP Bearer Authentication Authenticates using bearer token such as a JWT, etc. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The bearer token. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Delete an async EQL search Delete an asynchronous or stored synchronous EQL search in Elasticsearch v9 using the specified ID as a path parameter. ### Endpoint - **URL:** `/_eql/search/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------ | | `path_parameters.id` | string | Required | Identifier for the search to delete. | ### Input Example `{"path_parameters":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `acknowledged` | boolean | Output field: acknowledged | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"acknowledged":true}}` ## Delete an async ES|QL query Cancel a running Elasticsearch v9 query or delete stored results using the query ID. ### Endpoint - **URL:** `/_query/async/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------- | | `path_parameters.id` | string | Required | The unique identifier of the query. | ### Input Example `{"path_parameters":{"id":"FmdMX2pIang3UWhLRU5QS0lqdlppYncaMUpYQ05oSkpTc3kwZ21EdC1tbFJXQToxOTI"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `acknowledged` | boolean | Output field: acknowledged | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"acknowledged":true}}` ## Delete an async search Cancel a running asynchronous search or delete saved search results in Elasticsearch v9 using the search ID. ### Endpoint - **URL:** `/_async_search/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.id` | string | Required | A unique identifier for the async search. | ### Input Example `{"path_parameters":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc="}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `acknowledged` | boolean | Output field: acknowledged | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"acknowledged":true}}` ## Get a specific running ES|QL query information Retrieve detailed information about a running ES|QL query in Elasticsearch v9 using the query ID. ### Endpoint - **URL:** `/_query/queries/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | The query ID. | ### Input Example `{"path_parameters":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `start_time_millis` | number | Output field: start\_time\_millis | | `running_time_nanos` | number | Output field: running\_time\_nanos | | `query` | string | Output field: query | | `coordinating_node` | string | Output field: coordinating\_node | | `data_nodes` | array | Response data | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE","name":"test1,test2","start_time_millis":1611690235000,"running_time_nanos":1000000000,"query":"SELECT * FROM test1, test2","coordinating_node":"node1","data_nodes":["node1","node2","node3"]}}` ## Get an ES|QL view Get the current status and available or stored results for an ES|QL view in Elasticsearch v9 using the specified name. ### Endpoint - **URL:** `/_query/view/{{name}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `path_parameters.name` | string | Required | The comma-separated view names to retrieve. Can be blank to return all views. | ### Input Example `{"path_parameters":{"name":"test1,test2"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `views` | array | Output field: views | | `views.name` | string | Name of the resource | | `views.query` | string | Output field: views.query | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"views":[{},{}]}}` ## Get async EQL search results Get the current status and available results for an async EQL search or a stored synchronous EQL search in Elasticsearch v9 using the specified ID. ### Endpoint - **URL:** `/_eql/search/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `parameters.keep_alive` | string | Optional | Period for which the search and its results are stored on the cluster. | | `parameters.wait_for_completion_timeout` | string | Optional | Timeout duration to wait for the request to finish; defaults to no timeout. | | `path_parameters.id` | string | Required | Identifier for the async or stored synchronous EQL search. | ### Input Example `{"parameters":{"keep_alive":"1m","wait_for_completion_timeout":"30s"},"path_parameters":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_partial` | boolean | Output field: is\_partial | | `is_running` | boolean | Output field: is\_running | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.events` | array | Output field: hits.events | | `hits.events._index` | string | Output field: hits.events.\_index | | `hits.events._id` | string | Unique identifier | | `hits.events._source` | object | Output field: hits.events.\_source | | `hits.events._source.@timestamp` | string | Output field: hits.events.\_source.\@timestamp | | `hits.events._source.event` | object | Output field: hits.events.\_source.event | | `hits.events._source.event.category` | string | Output field: hits.events.\_source.event.category | | `hits.events._source.event.id` | string | Unique identifier | | `hits.events._source.event.sequence` | number | Output field: hits.events.\_source.event.sequence | | `hits.events._source.process` | object | Output field: hits.events.\_source.process | | `hits.events._source.process.pid` | number | Unique identifier | | `hits.events._source.process.name` | string | Name of the resource | | `hits.events._source.process.command_line` | string | Output field: hits.events.\_source.process.command\_line | | `hits.events._source.process.executable` | string | Output field: hits.events.\_source.process.executable | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE","is_partial":false,"is_running":false,"took":6,"timed_out":false,"hits":{"total":{},"events":[]},"shard_failures":[]}}` ## Get async ES|QL query results Get the current status and available or stored results for an ES|QL asynchronous query in Elasticsearch v9 using the query ID. ### Endpoint - **URL:** `/_query/async/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ---------------------------------------- | -------- | ------------ | ----------------------------------- | ----------------------- | | `parameters.drop_null_columns` | boolean | Optional | Parameters for the Get async ES | QL query results action | | `parameters.format` | string | Optional | Parameters for the Get async ES | QL query results action | | `parameters.keep_alive` | string | Optional | Parameters for the Get async ES | QL query results action | | `parameters.wait_for_completion_timeout` | string | Optional | Parameters for the Get async ES | QL query results action | | `path_parameters.id` | string | Required | The unique identifier of the query. | | ### Input Example `{"parameters":{"drop_null_columns":true,"format":"json","keep_alive":"1m","wait_for_completion_timeout":"30s"},"path_parameters":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_running` | boolean | Output field: is\_running | | `took` | number | Output field: took | | `is_partial` | boolean | Output field: is\_partial | | `columns` | array | Output field: columns | | `columns.name` | string | Name of the resource | | `columns.type` | string | Type of the resource | | `values` | array | Value for the parameter | | `values.0` | string | Value for the parameter | | `values.1` | string | Value for the parameter | | `values.2` | string | Value for the parameter | | `values.3` | string | Value for the parameter | | `values.4` | string | Value for the parameter | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE","is_running":false,"took":48,"is_partial":false,"columns":[{"name":"author","type":"text"},{"name":"name","type":"text"},{"name":"page_count","type":"integer"}],"values":[["Peter F. Hamilton","Vernor Vinge","Frank Herbert","Alastair Reynolds","James S.A. Corey"],["Pandora's Star","A Deepness in the Sky","Dune","Revelation Space","Leviathan Wakes"],[768,613,604,585,561]]}}` ## Get async search results Retrieve results of a previously submitted asynchronous search request in Elasticsearch v9 using the search ID. ### Endpoint - **URL:** `/_async_search/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.keep_alive` | string | Optional | The length of time that the async search should be available in the cluster. | | `parameters.typed_keys` | boolean | Optional | Specify whether aggregation and suggester names should be prefixed by their respective types in the response. | | `parameters.wait_for_completion_timeout` | string | Optional | Specifies to wait for the search to be completed up until the provided timeout. | | `parameters.return_intermediate_results` | boolean | Optional | Specifies whether the response should contain intermediate results if the query is still running when the wait\_for\_completion\_timeout expires or if no wait\_for\_completion\_timeout is specified. | | `path_parameters.id` | string | Required | A unique identifier for the async search. | ### Input Example `{"parameters":{"keep_alive":"1m","typed_keys":false,"wait_for_completion_timeout":"30s","return_intermediate_results":false},"path_parameters":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_partial` | boolean | Output field: is\_partial | | `is_running` | boolean | Output field: is\_running | | `start_time_in_millis` | number | Output field: start\_time\_in\_millis | | `expiration_time_in_millis` | number | Output field: expiration\_time\_in\_millis | | `completion_time_in_millis` | number | Output field: completion\_time\_in\_millis | | `response` | object | Output field: response | | `response.took` | number | Output field: response.took | | `response.timed_out` | boolean | Output field: response.timed\_out | | `response.num_reduce_phases` | number | Output field: response.num\_reduce\_phases | | `response._shards` | object | Output field: response.\_shards | | `response._shards.total` | number | Output field: response.\_shards.total | | `response._shards.successful` | number | Whether the operation was successful | | `response._shards.skipped` | number | Output field: response.\_shards.skipped | | `response._shards.failed` | number | Output field: response.\_shards.failed | | `response.hits` | object | Output field: response.hits | | `response.hits.total` | object | Output field: response.hits.total | | `response.hits.total.value` | number | Value for the parameter | | `response.hits.total.relation` | string | Output field: response.hits.total.relation | | `response.hits.max_score` | object | Score value | | `response.hits.hits` | array | Output field: response.hits.hits | | `response.hits.hits.file_name` | string | Name of the resource | | `response.hits.hits.file` | string | Output field: response.hits.hits.file | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc=","is_partial":false,"is_running":false,"start_time_in_millis":1583945890986,"expiration_time_in_millis":1584377890986,"completion_time_in_millis":1583945903130,"response":{"took":12144,"timed_out":false,"num_reduce_phases":46,"_shards":{},"hits":{},"aggregations":{}}}}` ## Get EQL search results Retrieve search results for an Event Query Language (EQL) query in Elasticsearch v9 using specified index and query parameters. ### Endpoint - **URL:** `/{{index}}/_eql/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------ | | `parameters.allow_no_indices` | boolean | Optional | If true, index expressions that resolve to no indices are allowed and return an empty result. | | `parameters.allow_partial_search_results` | boolean | Optional | If true, returns partial results on shard failures; if false, returns an error. | | `parameters.allow_partial_sequence_results` | boolean | Optional | If true, sequence queries return partial results on shard failures; only applies when allow\_partial\_search\_results is true. | | `parameters.expand_wildcards` | string | Optional | Whether to expand wildcard expressions to concrete indices (all, open, closed, hidden, or none). | | `parameters.ccs_minimize_roundtrips` | boolean | Optional | Whether network round-trips should be minimized for cross-cluster search requests. | | `parameters.ignore_unavailable` | boolean | Optional | If false, errors on unavailable concrete targets; if true, silently ignores them. | | `parameters.keep_alive` | string | Optional | Period for which the search and its results are stored on the cluster. | | `parameters.keep_on_completion` | boolean | Optional | If true, the search and its results are stored on the cluster. | | `parameters.wait_for_completion_timeout` | string | Optional | Timeout duration to wait for the request to finish; defaults to no timeout. | | `path_parameters.index` | string | Required | Data stream, index, or alias to search. | | `query` | string | Optional | EQL query to run. | | `case_sensitive` | boolean | Optional | Whether the EQL query is case sensitive. | | `event_category_field` | string | Optional | Field containing the event classification, such as process, file, or network. | | `tiebreaker_field` | string | Optional | Field used to sort hits with the same timestamp in ascending order. | | `timestamp_field` | string | Optional | Field containing event timestamp. | | `fetch_size` | number | Optional | Maximum number of events to search at a time for sequence queries. | | `filter` | object | Optional | Query DSL filter applied to events on which the EQL query runs. | | `filter.term` | object | Optional | Parameter for Get EQL search results | | `filter.term.event.type` | string | Optional | Type of the resource | | `keep_alive` | string | Optional | Duration to keep the search and results stored on the cluster. | | `keep_on_completion` | boolean | Optional | If true, stores the search and its results on the cluster. | | `wait_for_completion_timeout` | string | Optional | Duration to wait for the request to finish. | | `allow_partial_search_results` | boolean | Optional | If true, query continues on shard failures and returns results from available shards. | | `allow_partial_sequence_results` | boolean | Optional | For sequences only; if true, returns results from available shards when allow\_partial\_search\_results is true. | | `size` | number | Optional | For basic queries, maximum number of matching events to return. | ### Input Example `{"parameters":{"allow_no_indices":true,"allow_partial_search_results":true,"allow_partial_sequence_results":true,"expand_wildcards":"open","ccs_minimize_roundtrips":true,"ignore_unavailable":false,"keep_alive":"1m","keep_on_completion":true,"wait_for_completion_timeout":"30s"},"json_body":{"query":"process where process.name == \"regsvr32.exe\"","case_sensitive":true,"event_category_field":"event.category","tiebreaker_field":"event.sequence","timestamp_field":"@timestamp","fetch_size":1000,"filter":{"term":{"event.type":"start"}},"keep_alive":"1m","keep_on_completion":true,"wait_for_completion_timeout":"30s","allow_partial_search_results":true,"allow_partial_sequence_results":false,"size":10,"fields":[{"field":"process.name","format":"text","include_unmapped":false}],"result_position":"tail","runtime_mappings":{"process_label":{"type":"keyword","script":{"source":"emit(doc['process.name'].value)","lang":"painless"}}},"max_samples_per_key":1},"path_parameters":{"index":"my-data-stream"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `is_partial` | boolean | Output field: is\_partial | | `is_running` | boolean | Output field: is\_running | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.sequences` | array | Output field: hits.sequences | | `hits.sequences.join_keys` | array | Output field: hits.sequences.join\_keys | | `hits.sequences.events` | array | Output field: hits.sequences.events | | `hits.sequences.events._index` | string | Output field: hits.sequences.events.\_index | | `hits.sequences.events._id` | string | Unique identifier | | `hits.sequences.events._source` | object | Output field: hits.sequences.events.\_source | | `hits.sequences.events._source.@timestamp` | string | Output field: hits.sequences.events.\_source.\@timestamp | | `hits.sequences.events._source.event` | object | Output field: hits.sequences.events.\_source.event | | `hits.sequences.events._source.process` | object | Output field: hits.sequences.events.\_source.process | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"is_partial":false,"is_running":false,"took":6,"timed_out":false,"hits":{"total":{},"sequences":[]}}}` ## Get running ES|QL queries information Returns an object containing IDs and other details about the running ES|QL queries in Elasticsearch v9. ### Endpoint - **URL:** `/_query/queries` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `queries` | object | Output field: queries | | `queries.id` | number | Unique identifier | | `queries.node` | string | Output field: queries.node | | `queries.start_time_millis` | number | Output field: queries.start\_time\_millis | | `queries.running_time_nanos` | number | Output field: queries.running\_time\_nanos | | `queries.query` | string | Output field: queries.query | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"queries":{"id":1111,"node":"node1","start_time_millis":1611690235000,"running_time_nanos":1000000000,"query":"SELECT * FROM test1, test2"}}}` ## Get the async EQL status Retrieve the current status of an asynchronous or stored synchronous EQL search in Elasticsearch v9 using the search ID. ### Endpoint - **URL:** `/_eql/search/status/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Get the current status for an async EQL search or a stored synchronous EQL search without returning results. | ### Input Example `{"path_parameters":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_running` | boolean | Output field: is\_running | | `is_partial` | boolean | Output field: is\_partial | | `start_time_in_millis` | number | Output field: start\_time\_in\_millis | | `expiration_time_in_millis` | number | Output field: expiration\_time\_in\_millis | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmNJRUZ1YWZCU3dHY1BIOUhaenVSRkEaaXFlZ3h4c1RTWFNocDdnY2FSaERnUTozNDE=","is_running":true,"is_partial":true,"start_time_in_millis":1611690235000,"expiration_time_in_millis":1611690295000}}` ## Get the async search status Retrieve the status of a previously submitted async search request in Elasticsearch v9 using its identifier, without fetching the search results. ### Endpoint - **URL:** `/_async_search/status/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------------------- | | `parameters.keep_alive` | string | Optional | The length of time that the async search needs to be available. | | `path_parameters.id` | string | Required | A unique identifier for the async search. | ### Input Example `{"parameters":{"keep_alive":"1m"},"path_parameters":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_running` | boolean | Output field: is\_running | | `is_partial` | boolean | Output field: is\_partial | | `start_time_in_millis` | number | Output field: start\_time\_in\_millis | | `expiration_time_in_millis` | number | Output field: expiration\_time\_in\_millis | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.skipped` | number | Output field: \_shards.skipped | | `_shards.failed` | number | Output field: \_shards.failed | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc=","is_running":true,"is_partial":true,"start_time_in_millis":1583945890986,"expiration_time_in_millis":1584377890986,"_shards":{"total":562,"successful":188,"skipped":0,"failed":0}}}` ## Run a search Retrieve search hits from Elasticsearch v9 that match the specified query in the request, using index as a path parameter. ### Endpoint - **URL:** `/{{index}}/_search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------- | | `parameters.allow_no_indices` | boolean | Optional | If true, index expressions that resolve to no indices are allowed and return an empty result. | | `parameters.allow_partial_search_results` | boolean | Optional | If true, returns partial results on shard timeouts or failures; if false, returns an error. | | `parameters.analyzer` | string | Optional | Analyzer for the query string; only valid when q is specified. | | `parameters.analyze_wildcard` | boolean | Optional | If true, wildcard and prefix queries are analyzed; only valid when q is specified. | | `parameters.batched_reduce_size` | number | Optional | Number of shard results reduced at once on the coordinating node. | | `parameters.ccs_minimize_roundtrips` | boolean | Optional | If true, minimizes network round-trips for cross-cluster search requests. | | `parameters.default_operator` | string | Optional | Default operator for query string query (and or or); only valid when q is specified. | | `parameters.df` | string | Optional | Default field when no field prefix is given in the query string; only valid when q is specified. | | `parameters.docvalue_fields` | array | Optional | Comma-separated list of fields to return as docvalue representation for each hit. | | `parameters.expand_wildcards` | string | Optional | Index types wildcard patterns can match (all, open, closed, hidden, or none). | | `parameters.explain` | boolean | Optional | If true, returns detailed score computation information as part of a hit. | | `parameters.ignore_throttled` | boolean | Optional | If true, concrete, expanded, or aliased indices are ignored when frozen. | | `parameters.ignore_unavailable` | boolean | Optional | If false, errors on unavailable concrete targets; if true, silently ignores them. | | `parameters.include_named_queries_score` | boolean | Optional | If true, includes score contribution from named queries in the response. | | `parameters.lenient` | boolean | Optional | If true, format-based query failures in the query string are ignored; only valid when q is specified. | | `parameters.max_concurrent_shard_requests` | number | Optional | Concurrent shard requests per node; limits search impact on the cluster. | | `parameters.preference` | string | Optional | Nodes and shards used for the search (e.g. \_local, \_only\_local, \_shards). | | `parameters.pre_filter_shard_size` | number | Optional | Threshold to enforce a pre-filter roundtrip when shard count exceeds this value. | | `parameters.request_cache` | boolean | Optional | If true, enables search result caching for requests where size is 0. | | `parameters.routing` | array | Optional | Custom routing value to route operations to a specific shard. | | `parameters.scroll` | string | Optional | Period to retain the search context for scrolling. | | `parameters.search_type` | string | Optional | How distributed term frequencies are calculated for relevance scoring. | | `parameters.stats` | array | Optional | Tags for logging and statistical purposes. | | `parameters.stored_fields` | array | Optional | Comma-separated list of stored fields to return as part of a hit. | | `parameters.suggest_field` | string | Optional | Field to use for suggestions. | ### Input Example `{"parameters":{"allow_no_indices":true,"allow_partial_search_results":true,"analyzer":"standard","analyze_wildcard":false,"batched_reduce_size":5,"ccs_minimize_roundtrips":true,"default_operator":"OR","df":"_all","docvalue_fields":["date"],"expand_wildcards":"open","explain":false,"ignore_throttled":true,"ignore_unavailable":false,"include_named_queries_score":false,"lenient":false,"max_concurrent_shard_requests":5,"preference":"_local","pre_filter_shard_size":128,"request_cache":true,"routing":[],"scroll":"1m","search_type":"query_then_fetch","stats":["search"],"stored_fields":[],"suggest_field":"title.suggest","suggest_mode":"missing","suggest_size":5,"suggest_text":"elasticsearch","terminate_after":0,"timeout":"1m","track_total_hits":true,"track_scores":false,"typed_keys":false,"rest_total_hits_as_int":false,"version":false,"_source":true,"_source_excludes":[],"_source_exclude_vectors":false,"_source_includes":["date"],"seq_no_primary_term":false,"q":"*:*","size":10,"from":0,"sort":"date:asc"},"json_body":{"aggregations":{"sale_date":{"date_histogram":{"field":"date","calendar_interval":"1d"}}},"collapse":{"field":"user.id","inner_hits":{"name":"recent_sales","size":3,"from":0,"collapse":{"field":"category.id"},"docvalue_fields":[{"field":"date","format":"epoch_millis","include_unmapped":false}],"explain":false,"highlight":{"fields":{"title":{}}},"ignore_unmapped":false,"script_fields":{"amount_usd":{"script":{"source":"doc['amount'].value","lang":"painless"},"ignore_failure":false}},"seq_no_primary_term":false,"fields":[{"field":"amount","format":"0.00","include_unmapped":false}],"sort":[{"date":{"order":"desc"}}],"_source":true,"stored_fields":["title"],"track_scores":false,"version":false}},"explain":false,"ext":{},"from":0,"highlight":{"type":"unified","boundary_chars":".,!? \t\n","boundary_max_scan":20,"boundary_scanner":"sentence","boundary_scanner_locale":"en-US","fragmenter":"span","fragment_size":100,"highlight_filter":true,"highlight_query":{"match":{"title":"elasticsearch"}},"max_fragment_length":0,"max_analyzed_offset":1000000,"no_match_size":0,"number_of_fragments":5,"options":{},"order":"score","phrase_limit":256,"post_tags":[""],"pre_tags":[""],"require_field_match":true,"encoder":"html","fields":{"title":{"type":"unified","fragment_size":150,"number_of_fragments":3}}},"track_total_hits":true,"indices_boost":[{"sales-*":1.5}],"docvalue_fields":[{"field":"date","format":"epoch_millis","include_unmapped":false}],"knn":{"field":"image_vector","query_vector":[0.12,0.34,0.56],"k":10,"num_candidates":100,"visit_percentage":50,"boost":1,"similarity":0.7,"filter":{"term":{"status":"published"}},"inner_hits":{"name":"knn_hits","size":3,"from":0,"_source":true,"track_scores":false,"version":false,"seq_no_primary_term":false}},"rescore_vector":{"oversample":2},"rank":{"rrf":{"retrievers":[{"standard":{"query":{"match":{"title":"elasticsearch"}}}},{"knn":{"field":"image_vector","query_vector":[0.12,0.34,0.56],"k":10,"num_candidates":100}}],"rank_constant":60,"rank_window_size":100}},"_name":"daily_sales_search","min_score":0.5,"post_filter":{"term":{"status":"published"}},"profile":false,"query":{"match_all":{}},"retriever":{"standard":{"query":{"match":{"title":"elasticsearch"}},"filter":{"term":{"status":"published"}},"min_score":0.5,"_name":"standard_retriever"}},"rescore":{"window_size":10,"query":{"rescore_query":{"match":{"title":"elasticsearch"}},"query_weight":1,"rescore_query_weight":2,"score_mode":"multiply"},"learning_to_rank":{"model_id":"ltr-model-1","params":{"keywords":"elasticsearch"}},"script":{"source":"return _score * 2;","lang":"painless"}},"script_fields":{"day_of_week":{"script":{"source":"doc['date'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT)","lang":"painless"},"ignore_failure":false}},"search_after":[1583945890986,"sale-001"],"size":10,"slice":{"id":"0","max":5,"field":"date"},"sort":[{"date":{"order":"asc"}}],"_source":{"includes":["date","amount"],"excludes":["internal_notes"]},"fields":[{"field":"date","format":"strict_date_optional_time","include_unmapped":false}],"suggest":{"text":"elasticsearch","simple_phrase":{"phrase":{"field":"title.trigram","size":1,"gram_size":3,"direct_generator":[{"field":"title.trigram","suggest_mode":"missing"}]}}},"terminate_after":0,"timeout":"1m","track_scores":false,"version":false,"seq_no_primary_term":false,"stored_fields":["title"],"pit":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc","keep_alive":"1m"},"runtime_mappings":{"day_of_week":{"type":"keyword","script":{"source":"emit(doc['date'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))","lang":"painless"}}},"stats":["search"]},"path_parameters":{"index":"_all"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `timed_out` | boolean | Output field: timed\_out | | `_shards` | object | Output field: \_shards | | `_shards.total` | number | Output field: \_shards.total | | `_shards.successful` | number | Whether the operation was successful | | `_shards.skipped` | number | Output field: \_shards.skipped | | `_shards.failed` | number | Output field: \_shards.failed | | `hits` | object | Output field: hits | | `hits.total` | object | Output field: hits.total | | `hits.total.value` | number | Value for the parameter | | `hits.total.relation` | string | Output field: hits.total.relation | | `hits.max_score` | number | Score value | | `hits.hits` | array | Output field: hits.hits | | `hits.hits._index` | string | Output field: hits.hits.\_index | | `hits.hits._id` | string | Unique identifier | | `hits.hits._score` | number | Score value | | `hits.hits._source` | object | Output field: hits.hits.\_source | | `hits.hits._source.@timestamp` | string | Output field: hits.hits.\_source.\@timestamp | | `hits.hits._source.http` | object | Output field: hits.hits.\_source.http | | `hits.hits._source.http.request` | object | Output field: hits.hits.\_source.http.request | | `hits.hits._source.http.response` | object | Output field: hits.hits.\_source.http.response | | `hits.hits._source.http.version` | string | Output field: hits.hits.\_source.http.version | | `hits.hits._source.source` | object | Output field: hits.hits.\_source.source | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"took":5,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{},"max_score":1.3862942,"hits":[]}}}` ## Run an async ES|QL query Asynchronously execute an ES|QL query in Elasticsearch v9, monitor its progress, and retrieve results upon completion. Requires a JSON body with the query. ### Endpoint - **URL:** `/_query/async` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ---------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------- | ----------------------- | | `parameters.allow_partial_results` | boolean | Optional | If true, returns partial results on shard failures; if false, the query fails on any failure. | | | `parameters.delimiter` | string | Optional | Character between values in a CSV row; valid only when format is csv. | | | `parameters.drop_null_columns` | boolean | Optional | If true, removes all-null columns from results and includes an all\_columns section. | | | `parameters.format` | string | Optional | Short version of the Accept header for the response format. | | | `query` | string | Optional | ES | QL query string to run. | | `columnar` | boolean | Optional | If true, returns results in columnar format for JSON, YAML, CBOR, and smile formats. | | | `filter` | object | Optional | Query DSL filter for the set of documents the ES | QL query runs on. | | `filter.term` | object | Optional | Parameter for Run an async ES | QL query | | `filter.term.event.dataset` | string | Optional | Response data | | | `time_zone` | string | Optional | Default timezone for the query. | | | `locale` | string | Optional | Locale used to format results, especially dates. | | | `params` | array | Optional | Parameter values for question mark (?) placeholders in the query string. | | | `profile` | boolean | Optional | If true, includes a profile object with query execution debugging information. | | | `tables` | object | Optional | Tables to use with the LOOKUP operation, keyed by table name and column name. | | | `tables.threat_list` | object | Optional | Parameter for Run an async ES | QL query | | `tables.threat_list.ip` | array | Optional | Parameter for Run an async ES | QL query | | `tables.threat_list.name` | array | Optional | Name of the resource | | | `include_ccs_metadata` | boolean | Optional | If true, includes \_clusters metadata for cross-cluster/cross-project queries. | | | `include_execution_metadata` | boolean | Optional | If true, includes execution metadata for CCS and non-CCS queries. | | | `wait_for_completion_timeout` | string | Optional | Period to wait for results before returning an async query ID. | | | `keep_alive` | string | Optional | Period the query and results are stored in the cluster. | | | `keep_on_completion` | boolean | Optional | If true, always stores the query and results on the cluster. | | ### Input Example `{"parameters":{"allow_partial_results":true,"delimiter":",","drop_null_columns":false,"format":"json"},"json_body":{"query":"FROM logs | WHERE status == ? AND @timestamp > ? | LIMIT 10","columnar":false,"filter":{"term":{"event.dataset":"logs"}},"time_zone":"UTC","locale":"en-US","params":["published","2024-01-01T00:00:00.000Z"],"profile":false,"tables":{"threat_list":{"ip":["1.2.3.4","5.6.7.8"],"name":["malware","phishing"]}},"include_ccs_metadata":false,"include_execution_metadata":false,"wait_for_completion_timeout":"1s","keep_alive":"5d","keep_on_completion":false}}` ### Output | **Parameter** | **Type** | **Description** | | | ----------------------------- | -------- | ---------------------------------------------------------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | | `reason` | string | Response reason phrase | | | `query` | string | ES | QL query string that was executed. | | `wait_for_completion_timeout` | string | Timeout used when waiting for query completion. | | | `include_ccs_metadata` | boolean | Whether cross-cluster metadata was requested in the query. | | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"query":"FROM library,remote-*:library | EVAL year = DATE_TRUNC(1 YEARS, release_date) | ...","wait_for_completion_timeout":"2s","include_ccs_metadata":true}}` ## Run an async search Execute a search asynchronously in Elasticsearch v9, returning partial results as shards complete. Requires path parameters including the index. ### Endpoint - **URL:** `/{{index}}/_async_search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `parameters.wait_for_completion_timeout` | string | Optional | Blocks and waits until the search is completed up to a certain timeout. | | `parameters.keep_alive` | string | Optional | Specifies how long the async search needs to be available. | | `parameters.keep_on_completion` | boolean | Optional | If true, results are stored for later retrieval when the search completes within the wait\_for\_completion\_timeout. | | `parameters.allow_no_indices` | boolean | Optional | A setting that does two separate checks on the index expression. | | `parameters.allow_partial_search_results` | boolean | Optional | Indicate if an error should be returned if there is a partial search failure or timeout. | | `parameters.analyzer` | string | Optional | The analyzer to use for the query string. | | `parameters.analyze_wildcard` | boolean | Optional | Specify whether wildcard and prefix queries should be analyzed. | | `parameters.batched_reduce_size` | number | Optional | Affects how often partial results become available, which happens whenever shard results are reduced. | | `parameters.ccs_minimize_roundtrips` | boolean | Optional | The default value is the only supported value. | | `parameters.default_operator` | string | Optional | The default operator for query string query (AND or OR). | | `parameters.df` | string | Optional | The field to use as default where no field prefix is given in the query string. | | `parameters.docvalue_fields` | array | Optional | Comma-separated list of fields to return as docvalue representation for each hit. | | `parameters.expand_wildcards` | string | Optional | Whether to expand wildcard expressions to concrete indices (all, open, closed, hidden, or none). | | `parameters.explain` | boolean | Optional | Whether to return detailed score computation information as part of a hit. | | `parameters.ignore_throttled` | boolean | Optional | Whether concrete, expanded, or aliased indices should be ignored when throttled. | | `parameters.ignore_unavailable` | boolean | Optional | If false, returns an error for missing or unavailable concrete indices; if true, silently ignores them. | | `parameters.lenient` | boolean | Optional | Whether format-based query failures (e.g. text on a numeric field) should be ignored. | | `parameters.max_concurrent_shard_requests` | number | Optional | Number of concurrent shard requests per node; use to limit search impact on the cluster. | | `parameters.preference` | string | Optional | Specifies the node or shard the operation should be performed on. | | `parameters.request_cache` | boolean | Optional | Whether request cache should be used for this request (defaults to true). | | `parameters.routing` | array | Optional | Comma-separated list of specific routing values. | | `parameters.search_type` | string | Optional | Search operation type. | | `parameters.stats` | array | Optional | Tags for logging and statistical purposes. | | `parameters.stored_fields` | array | Optional | Comma-separated list of stored fields to return as part of a hit. | | `parameters.suggest_field` | string | Optional | Field to use for suggestions. | ### Input Example `{"parameters":{"wait_for_completion_timeout":"30s","keep_alive":"1m","keep_on_completion":true,"allow_no_indices":true,"allow_partial_search_results":true,"analyzer":"standard","analyze_wildcard":false,"batched_reduce_size":5,"ccs_minimize_roundtrips":true,"default_operator":"OR","df":"_all","docvalue_fields":["date"],"expand_wildcards":"open","explain":false,"ignore_throttled":true,"ignore_unavailable":false,"lenient":false,"max_concurrent_shard_requests":5,"preference":"_local","request_cache":true,"routing":[],"search_type":"query_then_fetch","stats":["async_search"],"stored_fields":[],"suggest_field":"title.suggest","suggest_mode":"missing","suggest_size":5,"suggest_text":"elasticsearch","terminate_after":0,"timeout":"1m","track_total_hits":true,"track_scores":false,"typed_keys":false,"rest_total_hits_as_int":false,"version":false,"_source":true,"_source_excludes":[],"_source_includes":["date"],"seq_no_primary_term":false,"q":"*:*","size":10,"from":0,"sort":"date:asc"},"json_body":{"aggregations":{"sale_date":{"date_histogram":{"field":"date","calendar_interval":"1d"}}},"collapse":{"field":"user.id","inner_hits":{"name":"recent_sales","size":3,"from":0,"collapse":{"field":"category.id"},"docvalue_fields":[{"field":"date","format":"epoch_millis","include_unmapped":false}],"explain":false,"highlight":{"fields":{"title":{}}},"ignore_unmapped":false,"script_fields":{"amount_usd":{"script":{"source":"doc['amount'].value","lang":"painless"},"ignore_failure":false}},"seq_no_primary_term":false,"fields":[{"field":"amount","format":"0.00","include_unmapped":false}],"sort":[{"date":{"order":"desc"}}],"_source":true,"stored_fields":["title"],"track_scores":false,"version":false}},"explain":false,"ext":{},"from":0,"highlight":{"type":"unified","boundary_chars":".,!? \t\n","boundary_max_scan":20,"boundary_scanner":"sentence","boundary_scanner_locale":"en-US","fragmenter":"span","fragment_size":100,"highlight_filter":true,"highlight_query":{"match":{"title":"elasticsearch"}},"max_fragment_length":0,"max_analyzed_offset":1000000,"no_match_size":0,"number_of_fragments":5,"options":{},"order":"score","phrase_limit":256,"post_tags":[""],"pre_tags":[""],"require_field_match":true,"encoder":"html","fields":{"title":{"type":"unified","fragment_size":150,"number_of_fragments":3}}},"track_total_hits":true,"indices_boost":[{"sales-*":1.5}],"docvalue_fields":[{"field":"date","format":"epoch_millis","include_unmapped":false}],"knn":{"field":"image_vector","query_vector":[0.12,0.34,0.56],"query_vector_builder":{"text_embedding":{"model_id":"sentence-transformers__all-minilm-l6-v2","model_text":"search query text"}},"k":10,"num_candidates":100,"visit_percentage":50,"boost":1,"similarity":0.7,"filter":{"term":{"status":"published"}},"inner_hits":{"name":"knn_hits","size":3,"from":0,"_source":true,"track_scores":false,"version":false,"seq_no_primary_term":false}},"rescore_vector":{"oversample":2},"_name":"daily_sales_async_search","min_score":0.5,"post_filter":{"term":{"status":"published"}},"profile":false,"query":{"match_all":{}},"rescore":{"window_size":10,"query":{"rescore_query":{"match":{"title":"elasticsearch"}},"query_weight":1,"rescore_query_weight":2,"score_mode":"multiply"},"learning_to_rank":{"model_id":"ltr-model-1","params":{"keywords":"elasticsearch"}},"script":{"source":"return _score * 2;","lang":"painless"}},"script_fields":{"day_of_week":{"script":{"source":"doc['date'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT)","lang":"painless"},"ignore_failure":false}},"search_after":[1583945890986,"sale-001"],"size":10,"slice":{"id":"0","max":5,"field":"date"},"sort":[{"date":{"order":"asc"}}],"_source":{"includes":["date","amount"],"excludes":["internal_notes"]},"fields":[{"field":"date","format":"strict_date_optional_time","include_unmapped":false}],"suggest":{"text":"elasticsearch","simple_phrase":{"phrase":{"field":"title.trigram","size":1,"gram_size":3,"direct_generator":[{"field":"title.trigram","suggest_mode":"missing"}]}}},"terminate_after":0,"timeout":"1m","track_scores":false,"version":false,"seq_no_primary_term":false,"stored_fields":["title"],"pit":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc","keep_alive":"1m"},"runtime_mappings":{"day_of_week":{"type":"keyword","script":{"source":"emit(doc['date'].value.dayOfWeekEnum.getDisplayName(TextStyle.FULL, Locale.ROOT))","lang":"painless"}}},"stats":["async_search"]},"path_parameters":{"index":"_all"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `is_partial` | boolean | Output field: is\_partial | | `is_running` | boolean | Output field: is\_running | | `start_time_in_millis` | number | Output field: start\_time\_in\_millis | | `expiration_time_in_millis` | number | Output field: expiration\_time\_in\_millis | | `response` | object | Output field: response | | `response.took` | number | Output field: response.took | | `response.timed_out` | boolean | Output field: response.timed\_out | | `response.num_reduce_phases` | number | Output field: response.num\_reduce\_phases | | `response._shards` | object | Output field: response.\_shards | | `response._shards.total` | number | Output field: response.\_shards.total | | `response._shards.successful` | number | Whether the operation was successful | | `response._shards.skipped` | number | Output field: response.\_shards.skipped | | `response._shards.failed` | number | Output field: response.\_shards.failed | | `response.hits` | object | Output field: response.hits | | `response.hits.total` | object | Output field: response.hits.total | | `response.hits.total.value` | number | Value for the parameter | | `response.hits.total.relation` | string | Output field: response.hits.total.relation | | `response.hits.max_score` | object | Score value | | `response.hits.hits` | array | Output field: response.hits.hits | | `response.hits.hits.file_name` | string | Name of the resource | | `response.hits.hits.file` | string | Output field: response.hits.hits.file | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"id":"FmRldE8zREVEUzA2ZVpUeGs2ejJFUFEaMkZ5QTVrSTZSaVN3WlNFVmtlWHJsdzoxMDc=","is_partial":true,"is_running":true,"start_time_in_millis":1583945890986,"expiration_time_in_millis":1584377890986,"response":{"took":1122,"timed_out":false,"num_reduce_phases":0,"_shards":{},"hits":{}}}}` ## Run an ES|QL query Get search results for an ES|QL query in Elasticsearch v9 using the specified JSON body containing the query. ### Endpoint - **URL:** `/_query` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ---------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------- | ----------------------- | | `parameters.format` | string | Optional | Short version of the Accept header for the response format. | | | `parameters.delimiter` | string | Optional | Character between values in a CSV row; valid only when format is csv. | | | `parameters.drop_null_columns` | boolean | Optional | If true, removes all-null columns from results and includes an all\_columns section. | | | `parameters.allow_partial_results` | boolean | Optional | If true, returns partial results on shard failures; if false, the query fails on any failure. | | | `query` | string | Optional | ES | QL query string to run. | | `columnar` | boolean | Optional | If true, returns results in columnar format for JSON, YAML, CBOR, and smile formats. | | | `filter` | object | Optional | Query DSL filter for the set of documents the ES | QL query runs on. | | `filter.term` | object | Optional | Parameter for Run an ES | QL query | | `filter.term.event.dataset` | string | Optional | Response data | | | `time_zone` | string | Optional | Default timezone for the query. | | | `locale` | string | Optional | Locale used to format results, especially dates. | | | `params` | array | Optional | Parameter values for question mark (?) placeholders in the query string. | | | `profile` | boolean | Optional | If true, includes a profile object with query execution debugging information. | | | `tables` | object | Optional | Tables to use with the LOOKUP operation, keyed by table name and column name. | | | `tables.threat_list` | object | Optional | Parameter for Run an ES | QL query | | `tables.threat_list.ip` | array | Optional | Parameter for Run an ES | QL query | | `tables.threat_list.name` | array | Optional | Name of the resource | | | `include_ccs_metadata` | boolean | Optional | If true, includes \_clusters metadata for cross-cluster/cross-project queries. | | | `include_execution_metadata` | boolean | Optional | If true, includes execution metadata for CCS and non-CCS queries. | | ### Input Example `{"parameters":{"format":"json","delimiter":",","drop_null_columns":false,"allow_partial_results":true},"json_body":{"query":"FROM logs | WHERE status == ? AND @timestamp > ? | LIMIT 10","columnar":false,"filter":{"term":{"event.dataset":"logs"}},"time_zone":"UTC","locale":"en-US","params":["published","2024-01-01T00:00:00.000Z"],"profile":false,"tables":{"threat_list":{"ip":["1.2.3.4","5.6.7.8"],"name":["malware","phishing"]}},"include_ccs_metadata":false,"include_execution_metadata":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Stop async ES|QL query Interrupt an Elasticsearch v9 asynchronous query execution and return the results obtained so far. Requires the query ID as a path parameter. ### Endpoint - **URL:** `/_query/async/{{id}}/stop` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `parameters.drop_null_columns` | boolean | Optional | Indicates whether columns that are entirely null will be removed from the columns and values portion of the results. | | `path_parameters.id` | string | Required | The unique identifier of the query. | ### Input Example `{"parameters":{"drop_null_columns":true},"path_parameters":{"id":"FkpMRkJGS1gzVDRlM3g4ZzMyRGlLbkEaTXlJZHdNT09TU2VTZVBoNDM3cFZMUToxMDM"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `took` | number | Output field: took | | `is_partial` | boolean | Output field: is\_partial | | `all_columns` | array | Output field: all\_columns | | `all_columns.name` | string | Name of the resource | | `all_columns.type` | string | Type of the resource | | `columns` | array | Output field: columns | | `columns.name` | string | Name of the resource | | `columns.type` | string | Type of the resource | | `values` | array | Value for the parameter | | `values.0` | string | Value for the parameter | | `values.1` | string | Value for the parameter | | `values.2` | string | Value for the parameter | | `_clusters` | object | Output field: \_clusters | | `_clusters.total` | number | Output field: \_clusters.total | | `_clusters.successful` | number | Whether the operation was successful | | `_clusters.running` | number | Output field: \_clusters.running | | `_clusters.skipped` | number | Output field: \_clusters.skipped | | `_clusters.partial` | number | Output field: \_clusters.partial | | `_clusters.failed` | number | Output field: \_clusters.failed | | `_clusters.details` | object | Output field: \_clusters.details | | `_clusters.details.(local)` | object | Output field: \_clusters.details.(local) | | `_clusters.details.(local).status` | string | Status value | | `_clusters.details.(local).indices` | string | Output field: \_clusters.details.(local).indices | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"took":48,"is_partial":true,"all_columns":[{"name":"author","type":"text"},{"name":"name","type":"text"},{"name":"page_count","type":"integer"}],"columns":[{"name":"author","type":"text"},{"name":"name","type":"text"},{"name":"page_count","type":"integer"}],"values":[["Peter F. Hamilton","Vernor Vinge","Frank Herbert"],["Pandora's Star","A Deepness in the Sky","Dune"],[768,613,604]],"_clusters":{"total":2,"successful":2,"running":0,"skipped":0,"parti...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |