IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Get async EQL status API Features APIs »

› ›

ES|QL query API

edit

ES|QL query API

edit

Returns search results for an ES|QL (Elasticsearch query language) query.

POST /_query
{
  "query": """
    FROM library
    | EVAL year = DATE_TRUNC(1 YEARS, release_date)
    | STATS MAX(page_count) BY year
    | SORT year
    | LIMIT 5
  """
}

Request

edit

POST _query

Prerequisites

edit

If the Elasticsearch security features are enabled, you must have the read index privilege for the data stream, index, or alias you search.

Query parameters

edit

delimiter

(Optional, string) Separator for CSV results. Defaults to ,. The API only supports this parameter for CSV responses.

format

(Optional, string) Format for the response. For valid values, refer to Response formats.

You can also specify a format using the Accept HTTP header. If you specify both this parameter and the Accept HTTP header, this parameter takes precedence.

Request body

edit

columnar: (Optional, Boolean) If true, returns results in a columnar format. Defaults to false. The API only supports this parameter for CBOR, JSON, SMILE, and YAML responses. See Columnar results.
params: (Optional, array) Values for parameters in the query. For syntax, refer to Passing parameters to a query.
query: (Required, object) ES|QL query to run. For syntax, refer to Syntax reference.

Response body

edit

columns

(array of objects) Column headings for the search results. Each object is a column.

Properties of columns objects

name: (string) Name of the column.
type: (string) Data type for the column.

values

(array of arrays) Values for the search results.

« Get async EQL status API Features APIs »