[DOCS] EQL: Add collapsible sections to EQL search API response (#56232)

Add collapsible sections to the response parameter docs
of the EQL search API.

Also clarifies some language regarding documents and
events.
This commit is contained in:
James Rodewig 2020-05-05 15:59:19 -04:00
parent e1c5ca421e
commit e7df8b388e
1 changed files with 47 additions and 24 deletions

View File

@ -11,6 +11,8 @@ experimental::[]
Returns search results for an <<eql,Event Query Language (EQL)>> query.
In {es}, EQL assumes each document in an index corresponds to an event.
////
[source,console]
----
@ -120,7 +122,7 @@ Reserved for future use.
`filter`::
(Optional, <<query-dsl,query DSL object>>)
Query, written in query DSL, used to filter the documents on which the EQL query
Query, written in query DSL, used to filter the events on which the EQL query
runs.
`search_after`::
@ -129,9 +131,10 @@ Reserved for future use.
`size`::
(Optional, integer or float)
Maximum number of matching documents to return. Defaults to `50`. Values must be
Maximum number of matching events to return. Defaults to `50`. Values must be
greater than `0`.
[role="child_attributes"]
[[eql-search-api-response-body]]
==== {api-response-body-title}
@ -148,7 +151,7 @@ and the time at which the coordinating node is ready to send the response.
Took time includes:
* Communication time between the coordinating node and data nodes
* Time the request spends in a <<modules-threadpool,thread pool>>,
* Time the request spends in the `search` <<modules-threadpool,thread pool>>,
queued for execution
* Actual execution time
@ -161,58 +164,78 @@ Took time does *not* include:
`timed_out`::
(boolean)
If `true`, the request timed out before completion; returned results may be
partial or empty.
If `true`, the request timed out before completion.
`hits`::
(object)
Contains returned results and metadata.
Contains returned events and metadata.
+
.Properties of `hits`
[%collapsible%open]
====
`hits.total.value`::
`total`::
(object)
Metadata about the number of returned events.
+
.Properties of `total`
[%collapsible%open]
=====
`value`::
(integer)
Total number of returned documents.
Total number of returned events.
`hits.total.relation`::
`relation`::
+
--
(string)
Indicates whether the number of documents returned is accurate or a lower bound.
Indicates whether the number of events returned is accurate or a lower bound.
Returned values are:
`eq`::: Accurate
`gte`::: Lower bound, including returned documents
`gte`::: Lower bound, including returned events
--
=====
`hits.events`::
`events`::
(array of objects)
Contains returned documents matching the query. Each object represents a
matching document.
Contains returned events matching the query. Each object represents a
matching event.
+
.Properties of `events` objects
[%collapsible%open]
=====
`hits.events._index`::
`_index`::
(string)
Name of the index containing the returned document.
Name of the index containing the returned event.
`hits.events._id`::
`_id`::
(string)
Unique identifier for the returned document.
(string)
Unique identifier for the returned event.
This ID is only unique within the returned index.
`hits.events._score`::
`_score`::
(float)
Positive 32-bit floating point number indicating the relevance of the returned
document. See <<relevance-scores>>.
Positive 32-bit floating point number used to determine the relevance of the
returned event. See <<relevance-scores>>.
`hits.events._source`::
`_source`::
(object)
Object containing the original JSON body passed for the document at index time.
Original JSON body passed for the event at index time.
`hits.events.sort`::
`sort`::
(array)
Integer used as the sort value for the event.
+
By default, this is the event's <<eql-search-api-timestamp-field,timestamp
value>>, converted to milliseconds since the
https://en.wikipedia.org/wiki/Unix_time[Unix epoch].
=====
====
[[eql-search-api-example]]
==== {api-examples-title}