Get information for users in a paginated manner. You can optionally filter the results with a query.
NOTE: As opposed to the get user API, built-in users are excluded from the result. This API is only for native users. ##Required authorization
- Cluster privileges:
read_security
Body
-
Hide query attributes Show query attributes object
-
Hide ids attributes Show ids attributes object
-
Hide bool attributes Show bool attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
filter
object | array[object] The clause (query) must appear in matching documents. However, unlike
must, the score of the query will be ignored.One of: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide attributes Show attributes
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
External documentation -
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Returns documents that contain a specific prefix in a provided field.
External documentation -
Returns documents that contain terms within a provided range.
External documentation -
Returns documents that contain terms matching a regular expression.
External documentation -
Matches spans containing a term.
External documentation -
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Hide attributes Show attributes object
External documentation -
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
must
object | array[object] The clause (query) must appear in matching documents and will contribute to the score.
One of: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide attributes Show attributes
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
External documentation -
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Returns documents that contain a specific prefix in a provided field.
External documentation -
Returns documents that contain terms within a provided range.
External documentation -
Returns documents that contain terms matching a regular expression.
External documentation -
Matches spans containing a term.
External documentation -
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Hide attributes Show attributes object
External documentation -
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
must_not
object | array[object] The clause (query) must not appear in the matching documents. Because scoring is ignored, a score of
0is returned for all documents.One of: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide attributes Show attributes
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
External documentation -
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Returns documents that contain a specific prefix in a provided field.
External documentation -
Returns documents that contain terms within a provided range.
External documentation -
Returns documents that contain terms matching a regular expression.
External documentation -
Matches spans containing a term.
External documentation -
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Hide attributes Show attributes object
External documentation -
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
should
object | array[object] The clause (query) should appear in the matching document.
One of: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide attributes Show attributes
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
External documentation -
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Returns documents that contain a specific prefix in a provided field.
External documentation -
Returns documents that contain terms within a provided range.
External documentation -
Returns documents that contain terms matching a regular expression.
External documentation -
Matches spans containing a term.
External documentation -
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Hide attributes Show attributes object
External documentation -
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
-
-
Hide exists attributes Show exists attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Returns users that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Hide match_all attributes Show match_all attributes object
-
Returns users that contain a specific prefix in a provided field.
-
Returns users that contain terms within a provided range.
-
Hide simple_query_string attributes Show simple_query_string attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Analyzer used to convert text in the query string into tokens.
-
If
true, the query attempts to analyze wildcard terms in the query string. -
If
true, the parser creates a match_phrase query for each multi-position token. -
Values are
and,AND,or, orOR. -
Array of fields you wish to search. Accepts wildcard expressions. You also can boost relevance scores for matches to particular fields using a caret (
^) notation. Defaults to theindex.query.default_field indexsetting, which has a default value of*. flags
string Query flags can be either a single flag or a combination of flags, e.g.
OR|AND|PREFIX-
Maximum number of terms to which the query expands for fuzzy matching.
-
Number of beginning characters left unchanged for fuzzy matching.
-
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). -
If
true, format-based errors, such as providing a text value for a numeric field, are ignored. -
Query string in the simple query string syntax you wish to parse and use for search.
-
Suffix appended to quoted text in the query string.
-
-
Returns users that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Hide terms attributes Show terms attributes object
-
Returns users that contain terms matching a wildcard pattern.
-
-
The starting document offset. It must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. sort
string | object | array[string | object] One of: Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Hide attributes Show attributes
-
Hide _geo_distance attributes Show _geo_distance attributes object
-
Values are
min,max,sum,avg, ormedian. -
Values are
arcorplane. -
Values are
ascordesc. -
Values are
in,ft,yd,mi,nmi,km,m,cm, ormm. -
Hide nested attributes Show nested attributes object
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide filter attributes Show filter attributes object
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
-
Hide _script attributes Show _script attributes object
-
Values are
ascordesc. -
Hide script attributes Show script attributes object
-
Values are
string,number, orversion. -
Values are
min,max,sum,avg, ormedian. -
Hide nested attributes Show nested attributes object
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide filter attributes Show filter attributes object
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Returns documents based on the order and proximity of matching terms.
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query. -
Analyzes the text and creates a phrase query out of the analyzed text.
-
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
-
Returns documents that contain a specific prefix in a provided field.
-
Returns documents that contain terms within a provided range.
-
Returns documents that contain terms matching a regular expression.
-
Matches spans containing a term.
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
-
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
-
Supports returning text_expansion query results by sending in precomputed tokens with the query.
-
Returns documents that contain terms matching a wildcard pattern.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
One of: Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Hide attributes Show attributes
-
Hide _geo_distance attributes Show _geo_distance attributes object
-
Values are
min,max,sum,avg, ormedian. -
Values are
arcorplane. -
Values are
ascordesc. -
Values are
in,ft,yd,mi,nmi,km,m,cm, ormm. -
Hide nested attributes Show nested attributes object
-
-
Hide _script attributes Show _script attributes object
-
Values are
ascordesc. -
Values are
string,number, orversion. -
Values are
min,max,sum,avg, ormedian. -
Hide nested attributes Show nested attributes object
-
-
The number of hits to return. It must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. -
A field value.
GET /_security/_query/user
curl \
--request POST 'http://api.example.com/_security/_query/user' \
--header "Content-Type: application/json" \
--data '"{\n \"query\": {\n \"prefix\": {\n \"roles\": \"other\"\n }\n }\n}"'{
"query": {
"prefix": {
"roles": "other"
}
}
}{
"query": {
"bool": {
"must": [
{
"wildcard": {
"email": "*example.com"
}
},
{
"term": {
"enabled": true
}
}
],
"filter": [
{
"wildcard": {
"roles": "*other*"
}
}
]
}
},
"from": 1,
"size": 2,
"sort": [
{ "username": { "order": "desc"} }
]
}{
"total": 1,
"count": 1,
"users": [
{
"username": "jacknich",
"roles": [
"admin",
"other_role1"
],
"full_name": "Jack Nicholson",
"email": "jacknich@example.com",
"metadata": {
"intelligence": 7
},
"enabled": true,
"profile_uid": "u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0"
}
]
}{
"total": 5,
"count": 2,
"users": [
{
"username": "ray",
"roles": [
"other_role3"
],
"full_name": "Ray Nicholson",
"email": "rayn@example.com",
"metadata": {
"intelligence": 7
},
"enabled": true,
"_sort": [
"ray"
]
},
{
"username": "lorraine",
"roles": [
"other_role3"
],
"full_name": "Lorraine Nicholson",
"email": "lorraine@example.com",
"metadata": {
"intelligence": 7
},
"enabled": true,
"_sort": [
"lorraine"
]
}
]
}{
"total": 2,
"count": 2,
"users": [
{
"username": "jacknich",
"roles": [
"admin",
"other_role1"
],
"full_name": "Jack Nicholson",
"email": "jacknich@example.com",
"metadata": {
"intelligence": 7
},
"enabled": true
},
{
"username": "sandrakn",
"roles": [
"admin",
"other_role1"
],
"full_name": "Sandra Knight",
"email": "sandrakn@example.com",
"metadata": {
"intelligence": 7
},
"enabled": true
}
]
}