stack es fleet msearch cli command

elastic stack es fleet msearch [options]
		

Run multiple Fleet searches.

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--allow-no-indices

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

--ccs-minimize-roundtrips

If true, network roundtrips between the coordinating node and remote clusters are minimized for cross-cluster search requests.

--expand-wildcards enum

Type of index that wildcard expressions can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams.

Values: all, open, closed, hidden, none

Repeatable: pass --expand-wildcards multiple times to supply more than one value

--ignore-throttled

If true, concrete, expanded or aliased indices are ignored when frozen.

--ignore-unavailable

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

--max-concurrent-searches number

Maximum number of concurrent searches the multi search API can execute.

--max-concurrent-shard-requests number

Maximum number of concurrent shard requests that each sub-search request executes per node.

--pre-filter-shard-size number

Defines a threshold that enforces a pre-filter roundtrip to prefilter search shards based on query rewriting if the number of shards the search request expands to exceeds the threshold. This filter roundtrip can limit the number of shards significantly if for instance a shard can not match any documents based on its rewrite method i.e., if date filters are mandatory to match but the shard bounds and the query are disjoint.

--search-type enum

Indicates whether global term and document frequencies should be used when scoring returned documents.

Values: query_then_fetch, dfs_query_then_fetch

--rest-total-hits-as-int

If true, hits.total are returned as an integer in the response. Defaults to false, which returns an object.

--typed-keys

Specifies whether aggregation and suggester names should be prefixed by their respective types in the response.

--wait-for-checkpoints string[]

A comma separated list of checkpoints. When configured, the search API will only be executed on a shard after the relevant checkpoint has become visible for search. Defaults to an empty list which will cause Elasticsearch to immediately execute the search.

Repeatable: pass --wait-for-checkpoints multiple times to supply more than one value

--allow-partial-search-results

If true, returns partial results if there are shard request timeouts or shard failures. If false, returns an error with no partial results. Defaults to the configured cluster setting search.default_allow_partial_results, which is true by default.

--searches string[]

Repeatable: pass --searches multiple times to supply more than one value

--index string

A single target to search. If the target is an index alias, it must resolve to a single index.

--error-trace

When set to true Elasticsearch will include the full stack trace of errors when they occur.

--filter-path string

Comma-separated list of filters in dot notation which reduce the response returned by Elasticsearch.

Repeatable: pass --filter-path multiple times to supply more than one value

--human

When set to true will return statistics in a format suitable for humans. For example "exists_time": "1h" for humans and "exists_time_in_millis": 3600000 for computers. When disabled the human readable values will be omitted. This makes sense for responses being consumed only by machines.

--pretty

If set to true the returned JSON will be "pretty-formatted". Only use this option for debugging only.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON