Get async EQL search results Added in 7.9.0
Get the current status and available results for an async EQL search or a stored synchronous EQL search.
Path parameters
-
Identifier for the search.
Query parameters
-
keep_alive string
Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.
-
wait_for_completion_timeout string
Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.
GET /_eql/search/{id}
curl \
-X GET http://api.example.com/_eql/search/{id}
Response examples (200)
{
"id": "string",
"is_partial": true,
"is_running": true,
"": 42.0,
"timed_out": true,
"hits": {
"total": {
"relation": "eq",
"value": 42.0
},
"events": [
{
"_index": "string",
"_id": "string",
"_source": {},
"missing": true,
"fields": {
"additionalProperty1": [
{}
],
"additionalProperty2": [
{}
]
}
}
],
"sequences": [
{
"events": [
{
"_index": "string",
"_id": "string",
"_source": {},
"missing": true,
"fields": {}
}
],
"join_keys": [
{}
]
}
]
}
}