diff --git a/docs/reference/eql/eql-search-api.asciidoc b/docs/reference/eql/eql-search-api.asciidoc
new file mode 100644
index 00000000000..6d3fd96871e
--- /dev/null
+++ b/docs/reference/eql/eql-search-api.asciidoc
@@ -0,0 +1,313 @@
+[role="xpack"]
+[testenv="basic"]
+
+[[eql-search-api]]
+=== EQL search API
+++++
+EQL search
+++++
+
+experimental::[]
+
+Returns search results for an <> query.
+
+////
+[source,console]
+----
+PUT my_index/_bulk?refresh
+{"index":{"_index" : "my_index", "_id" : "1"}}
+{ "@timestamp": "2020-12-06T11:04:05.000Z", "agent": { "id": "8a4f500d" }, "event": { "category": "process" }, "process": { "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe" } }
+{"index":{"_index" : "my_index", "_id" : "2"}}
+{ "@timestamp": "2020-12-06T11:04:07.000Z", "agent": { "id": "8a4f500d" }, "event": { "category": "file" }, "file": { "accessed": "2020-12-07T11:07:08.000Z", "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe", "type": "file", "size": 16384 }, "process": { "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe" } }
+{"index":{"_index" : "my_index", "_id" : "3"}}
+{ "@timestamp": "2020-12-07T11:06:07.000Z", "agent": { "id": "8a4f500d" }, "event": { "category": "process" }, "process": { "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe" } }
+{"index":{"_index" : "my_index", "_id" : "4"}}
+{ "@timestamp": "2020-12-07T11:07:08.000Z", "agent": { "id": "8a4f500d" }, "event": { "category": "file" }, "file": { "accessed": "2020-12-07T11:07:08.000Z", "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe", "type": "file", "size": 16384 }, "process": { "name": "cmd.exe", "path": "C:\\Windows\\System32\\cmd.exe" } }
+{"index":{"_index" : "my_index", "_id" : "5"}}
+{ "@timestamp": "2020-12-07T11:07:09.000Z", "agent": { "id": "8a4f500d" }, "event": { "category": "process" }, "process": { "name": "regsvr32.exe", "path": "C:\\Windows\\System32\\regsvr32.exe" } }
+----
+// TESTSETUP
+////
+
+[source,console]
+----
+GET my_index/_eql/search
+{
+ "query": """
+ process where process.name = "regsvr32.exe"
+ """
+}
+----
+
+[[eql-search-api-request]]
+==== {api-request-title}
+
+`GET /_eql/search`
+
+`POST /_eql/search`
+
+[[eql-search-api-prereqs]]
+==== {api-prereq-title}
+
+See <>.
+
+[[eql-search-api-limitations]]
+===== Limitations
+
+See <>.
+
+[[eql-search-api-path-params]]
+==== {api-path-parms-title}
+
+``::
+(Required, string)
+Comma-separated list of index names or <> used to
+limit the request. Accepts wildcard expressions.
++
+To search all indices, use `_all` or `*`.
+
+[[eql-search-api-query-params]]
+==== {api-query-parms-title}
+
+include::{docdir}/rest-api/common-parms.asciidoc[tag=allow-no-indices]
++
+Defaults to `false`.
+
+include::{docdir}/rest-api/common-parms.asciidoc[tag=expand-wildcards]
++
+Defaults to `open`.
+
+include::{docdir}/rest-api/common-parms.asciidoc[tag=index-ignore-unavailable]
+
+[[eql-search-api-request-body]]
+==== {api-request-body-title}
+
+`query`::
+(Required, string)
+<> query you wish to run.
++
+IMPORTANT: This parameter supports a subset of EQL syntax. See
+<>.
+
+`event_category_field`::
+(Required*, string)
+Field containing the event classification, such as `process`, `file`, or
+`network`.
++
+Defaults to `event.category`, as defined in the {ecs-ref}/ecs-event.html[Elastic
+Common Schema (ECS)]. If an index does not contain the `event.category` field,
+this value is required.
+
+[[eql-search-api-timestamp-field]]
+`timestamp_field`::
++
+--
+(Required*, string)
+Field containing event timestamp.
+
+Defaults to `@timestamp`, as defined in the
+{ecs-ref}/ecs-event.html[Elastic Common Schema (ECS)]. If an index does not
+contain the `@timestamp` field, this value is required.
+
+Events in the API response are sorted by this field's value, converted to
+milliseconds since the https://en.wikipedia.org/wiki/Unix_time[Unix epoch], in
+ascending order.
+--
+
+`implicit_join_key_field`::
+(Optional, string)
+Reserved for future use.
+
+`filter`::
+(Optional, <>)
+Query, written in query DSL, used to filter the documents on which the EQL query
+runs.
+
+`search_after`::
+(Optional, string)
+Reserved for future use.
+
+`size`::
+(Optional, integer or float)
+Maximum number of matching documents to return. Defaults to `50`. Values must be
+greater than `0`.
+
+[[eql-search-api-response-body]]
+==== {api-response-body-title}
+
+`took`::
++
+--
+(integer)
+Milliseconds it took {es} to execute the request.
+
+This value is calculated by measuring the time elapsed
+between receipt of a request on the coordinating node
+and the time at which the coordinating node is ready to send the response.
+
+Took time includes:
+
+* Communication time between the coordinating node and data nodes
+* Time the request spends in a <>,
+ queued for execution
+* Actual execution time
+
+Took time does *not* include:
+
+* Time needed to send the request to {es}
+* Time needed to serialize the JSON response
+* Time needed to send the response to a client
+--
+
+`timed_out`::
+(boolean)
+If `true`, the request timed out before completion; returned results may be
+partial or empty.
+
+`hits`::
+(object)
+Contains returned results and metadata.
+
+`hits.total.value`::
+(integer)
+Total number of returned documents.
+
+`hits.total.relation`::
++
+--
+(string)
+Indicates whether the number of documents returned is accurate or a lower bound.
+
+Returned values are:
+
+`eq`::: Accurate
+`gte`::: Lower bound, including returned documents
+--
+
+`hits.events`::
+(array of objects)
+Contains returned documents matching the query. Each object represents a
+matching document.
+
+`hits.events._index`::
+(string)
+Name of the index containing the returned document.
+
+`hits.events._id`::
+(string)
+Unique identifier for the returned document.
+
+`hits.events._score`::
+(float)
+Positive 32-bit floating point number indicating the relevance of the returned
+document. See <>.
+
+`hits.events._source`::
+(object)
+Object containing the original JSON body passed for the document at index time.
+
+`hits.events.sort`::
+(array)
+Integer used as the sort value for the event.
++
+By default, this is the event's <>, converted to milliseconds since the
+https://en.wikipedia.org/wiki/Unix_time[Unix epoch].
+
+[[eql-search-api-example]]
+==== {api-examples-title}
+
+The following EQL search request searches for events with an `event.category` of
+`file` that meet the following conditions:
+
+* A `file.name` of `cmd.exe`
+* An `agent.id` that is _not_ `my_user`
+
+[source,console]
+----
+GET my_index/_eql/search
+{
+ "query": """
+ file where (file.name == "cmd.exe" and agent.id != "my_user")
+ """
+}
+----
+
+The API returns the following response. Events in the response are sorted by
+<>, converted to milliseconds since
+the https://en.wikipedia.org/wiki/Unix_time[Unix epoch], in ascending order.
+
+[source,console-result]
+----
+{
+ "took": 6,
+ "timed_out": false,
+ "hits": {
+ "total": {
+ "value": 2,
+ "relation": "eq"
+ },
+ "events": [
+ {
+ "_index": "my_index",
+ "_type": "_doc",
+ "_id": "2",
+ "_score": null,
+ "_source": {
+ "@timestamp": "2020-12-06T11:04:07.000Z",
+ "agent": {
+ "id": "8a4f500d"
+ },
+ "event": {
+ "category": "file"
+ },
+ "file": {
+ "accessed": "2020-12-07T11:07:08.000Z",
+ "name": "cmd.exe",
+ "path": "C:\\Windows\\System32\\cmd.exe",
+ "type": "file",
+ "size": 16384
+ },
+ "process": {
+ "name": "cmd.exe",
+ "path": "C:\\Windows\\System32\\cmd.exe"
+ }
+ },
+ "sort": [
+ 1607252647000
+ ]
+ },
+ {
+ "_index": "my_index",
+ "_type": "_doc",
+ "_id": "4",
+ "_score": null,
+ "_source": {
+ "@timestamp": "2020-12-07T11:07:08.000Z",
+ "agent": {
+ "id": "8a4f500d"
+ },
+ "event": {
+ "category": "file"
+ },
+ "file": {
+ "accessed": "2020-12-07T11:07:08.000Z",
+ "name": "cmd.exe",
+ "path": "C:\\Windows\\System32\\cmd.exe",
+ "type": "file",
+ "size": 16384
+ },
+ "process": {
+ "name": "cmd.exe",
+ "path": "C:\\Windows\\System32\\cmd.exe"
+ }
+ },
+ "sort": [
+ 1607339228000
+ ]
+ }
+ ]
+ }
+}
+----
+// TESTRESPONSE[s/"took": 6/"took": $body.took/]
\ No newline at end of file
diff --git a/docs/reference/search.asciidoc b/docs/reference/search.asciidoc
index a33807cf698..606a19dc14a 100644
--- a/docs/reference/search.asciidoc
+++ b/docs/reference/search.asciidoc
@@ -166,6 +166,12 @@ include::search/suggesters.asciidoc[]
include::search/multi-search.asciidoc[]
+ifdef::permanently-unreleased-branch[]
+
+include::eql/eql-search-api.asciidoc[]
+
+endif::[]
+
include::search/count.asciidoc[]
include::search/validate.asciidoc[]
diff --git a/x-pack/plugin/src/test/resources/rest-api-spec/api/eql.search.json b/x-pack/plugin/src/test/resources/rest-api-spec/api/eql.search.json
index 4e56583722b..b9ba460d6a9 100644
--- a/x-pack/plugin/src/test/resources/rest-api-spec/api/eql.search.json
+++ b/x-pack/plugin/src/test/resources/rest-api-spec/api/eql.search.json
@@ -1,7 +1,7 @@
{
"eql.search":{
"documentation":{
- "url":"https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html",
+ "url":"https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html",
"description": "Returns results matching a query expressed in Event Query Language (EQL)"
},
"stability": "beta",