[DOCS] EQL: Add collapsible sections to EQL search API response (#56232)
Add collapsible sections to the response parameter docs of the EQL search API. Also clarifies some language regarding documents and events.
This commit is contained in:
parent
e1c5ca421e
commit
e7df8b388e
|
@ -11,6 +11,8 @@ experimental::[]
|
||||||
|
|
||||||
Returns search results for an <<eql,Event Query Language (EQL)>> query.
|
Returns search results for an <<eql,Event Query Language (EQL)>> query.
|
||||||
|
|
||||||
|
In {es}, EQL assumes each document in an index corresponds to an event.
|
||||||
|
|
||||||
////
|
////
|
||||||
[source,console]
|
[source,console]
|
||||||
----
|
----
|
||||||
|
@ -120,7 +122,7 @@ Reserved for future use.
|
||||||
|
|
||||||
`filter`::
|
`filter`::
|
||||||
(Optional, <<query-dsl,query DSL object>>)
|
(Optional, <<query-dsl,query DSL object>>)
|
||||||
Query, written in query DSL, used to filter the documents on which the EQL query
|
Query, written in query DSL, used to filter the events on which the EQL query
|
||||||
runs.
|
runs.
|
||||||
|
|
||||||
`search_after`::
|
`search_after`::
|
||||||
|
@ -129,9 +131,10 @@ Reserved for future use.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(Optional, integer or float)
|
(Optional, integer or float)
|
||||||
Maximum number of matching documents to return. Defaults to `50`. Values must be
|
Maximum number of matching events to return. Defaults to `50`. Values must be
|
||||||
greater than `0`.
|
greater than `0`.
|
||||||
|
|
||||||
|
[role="child_attributes"]
|
||||||
[[eql-search-api-response-body]]
|
[[eql-search-api-response-body]]
|
||||||
==== {api-response-body-title}
|
==== {api-response-body-title}
|
||||||
|
|
||||||
|
@ -148,7 +151,7 @@ and the time at which the coordinating node is ready to send the response.
|
||||||
Took time includes:
|
Took time includes:
|
||||||
|
|
||||||
* Communication time between the coordinating node and data nodes
|
* Communication time between the coordinating node and data nodes
|
||||||
* Time the request spends in a <<modules-threadpool,thread pool>>,
|
* Time the request spends in the `search` <<modules-threadpool,thread pool>>,
|
||||||
queued for execution
|
queued for execution
|
||||||
* Actual execution time
|
* Actual execution time
|
||||||
|
|
||||||
|
@ -161,58 +164,78 @@ Took time does *not* include:
|
||||||
|
|
||||||
`timed_out`::
|
`timed_out`::
|
||||||
(boolean)
|
(boolean)
|
||||||
If `true`, the request timed out before completion; returned results may be
|
If `true`, the request timed out before completion.
|
||||||
partial or empty.
|
|
||||||
|
|
||||||
`hits`::
|
`hits`::
|
||||||
(object)
|
(object)
|
||||||
Contains returned results and metadata.
|
Contains returned events and metadata.
|
||||||
|
+
|
||||||
|
.Properties of `hits`
|
||||||
|
[%collapsible%open]
|
||||||
|
====
|
||||||
|
|
||||||
`hits.total.value`::
|
`total`::
|
||||||
|
(object)
|
||||||
|
Metadata about the number of returned events.
|
||||||
|
+
|
||||||
|
.Properties of `total`
|
||||||
|
[%collapsible%open]
|
||||||
|
=====
|
||||||
|
|
||||||
|
`value`::
|
||||||
(integer)
|
(integer)
|
||||||
Total number of returned documents.
|
Total number of returned events.
|
||||||
|
|
||||||
`hits.total.relation`::
|
`relation`::
|
||||||
+
|
+
|
||||||
--
|
--
|
||||||
(string)
|
(string)
|
||||||
Indicates whether the number of documents returned is accurate or a lower bound.
|
Indicates whether the number of events returned is accurate or a lower bound.
|
||||||
|
|
||||||
Returned values are:
|
Returned values are:
|
||||||
|
|
||||||
`eq`::: Accurate
|
`eq`::: Accurate
|
||||||
`gte`::: Lower bound, including returned documents
|
`gte`::: Lower bound, including returned events
|
||||||
--
|
--
|
||||||
|
=====
|
||||||
|
|
||||||
`hits.events`::
|
`events`::
|
||||||
(array of objects)
|
(array of objects)
|
||||||
Contains returned documents matching the query. Each object represents a
|
Contains returned events matching the query. Each object represents a
|
||||||
matching document.
|
matching event.
|
||||||
|
+
|
||||||
|
.Properties of `events` objects
|
||||||
|
[%collapsible%open]
|
||||||
|
=====
|
||||||
|
|
||||||
`hits.events._index`::
|
`_index`::
|
||||||
(string)
|
(string)
|
||||||
Name of the index containing the returned document.
|
Name of the index containing the returned event.
|
||||||
|
|
||||||
`hits.events._id`::
|
`_id`::
|
||||||
(string)
|
(string)
|
||||||
Unique identifier for the returned document.
|
(string)
|
||||||
|
Unique identifier for the returned event.
|
||||||
|
This ID is only unique within the returned index.
|
||||||
|
|
||||||
`hits.events._score`::
|
`_score`::
|
||||||
(float)
|
(float)
|
||||||
Positive 32-bit floating point number indicating the relevance of the returned
|
Positive 32-bit floating point number used to determine the relevance of the
|
||||||
document. See <<relevance-scores>>.
|
returned event. See <<relevance-scores>>.
|
||||||
|
|
||||||
`hits.events._source`::
|
`_source`::
|
||||||
(object)
|
(object)
|
||||||
Object containing the original JSON body passed for the document at index time.
|
Original JSON body passed for the event at index time.
|
||||||
|
|
||||||
`hits.events.sort`::
|
`sort`::
|
||||||
(array)
|
(array)
|
||||||
Integer used as the sort value for the event.
|
Integer used as the sort value for the event.
|
||||||
+
|
+
|
||||||
By default, this is the event's <<eql-search-api-timestamp-field,timestamp
|
By default, this is the event's <<eql-search-api-timestamp-field,timestamp
|
||||||
value>>, converted to milliseconds since the
|
value>>, converted to milliseconds since the
|
||||||
https://en.wikipedia.org/wiki/Unix_time[Unix epoch].
|
https://en.wikipedia.org/wiki/Unix_time[Unix epoch].
|
||||||
|
=====
|
||||||
|
====
|
||||||
|
|
||||||
[[eql-search-api-example]]
|
[[eql-search-api-example]]
|
||||||
==== {api-examples-title}
|
==== {api-examples-title}
|
||||||
|
|
Loading…
Reference in New Issue