Get async EQL search results

  • GET /_eql/search/{id}
Auth

Get the current status and available results for an async EQL search or a stored synchronous EQL search.

Path parameters

id string required

Identifier for the search.

Query parameters

keep_alive string · default: 5d

Period for which the search and its results are stored on the cluster. Defaults to the keep_alive value set by the search’s EQL search API request.

wait_for_completion_timeout string

Timeout duration to wait for the request to finish. Defaults to no timeout, meaning the request waits for complete search results.

Reference

Response

application/json
id string

Identifier for the search.

is_partial boolean

If true, the response does not contain complete search results.

is_running boolean

If true, the search request is still executing.

took number

Milliseconds it took Elasticsearch to execute the request.

timed_out boolean

If true, the request timed out before completion.

hits object required

Contains matching events and sequences. Also contains related metadata.