[DOCS] EQL: Add collapsible sections to EQL search API response (#56232)

Add collapsible sections to the response parameter docs
of the EQL search API.

Also clarifies some language regarding documents and
events.
This commit is contained in:
James Rodewig 2020-05-05 15:59:19 -04:00
parent e1c5ca421e
commit e7df8b388e
1 changed files with 47 additions and 24 deletions

View File

@ -11,6 +11,8 @@ experimental::[]
Returns search results for an <<eql,Event Query Language (EQL)>> query. Returns search results for an <<eql,Event Query Language (EQL)>> query.
In {es}, EQL assumes each document in an index corresponds to an event.
//// ////
[source,console] [source,console]
---- ----
@ -120,7 +122,7 @@ Reserved for future use.
`filter`:: `filter`::
(Optional, <<query-dsl,query DSL object>>) (Optional, <<query-dsl,query DSL object>>)
Query, written in query DSL, used to filter the documents on which the EQL query Query, written in query DSL, used to filter the events on which the EQL query
runs. runs.
`search_after`:: `search_after`::
@ -129,9 +131,10 @@ Reserved for future use.
`size`:: `size`::
(Optional, integer or float) (Optional, integer or float)
Maximum number of matching documents to return. Defaults to `50`. Values must be Maximum number of matching events to return. Defaults to `50`. Values must be
greater than `0`. greater than `0`.
[role="child_attributes"]
[[eql-search-api-response-body]] [[eql-search-api-response-body]]
==== {api-response-body-title} ==== {api-response-body-title}
@ -148,7 +151,7 @@ and the time at which the coordinating node is ready to send the response.
Took time includes: Took time includes:
* Communication time between the coordinating node and data nodes * Communication time between the coordinating node and data nodes
* Time the request spends in a <<modules-threadpool,thread pool>>, * Time the request spends in the `search` <<modules-threadpool,thread pool>>,
queued for execution queued for execution
* Actual execution time * Actual execution time
@ -161,58 +164,78 @@ Took time does *not* include:
`timed_out`:: `timed_out`::
(boolean) (boolean)
If `true`, the request timed out before completion; returned results may be If `true`, the request timed out before completion.
partial or empty.
`hits`:: `hits`::
(object) (object)
Contains returned results and metadata. Contains returned events and metadata.
+
.Properties of `hits`
[%collapsible%open]
====
`hits.total.value`:: `total`::
(object)
Metadata about the number of returned events.
+
.Properties of `total`
[%collapsible%open]
=====
`value`::
(integer) (integer)
Total number of returned documents. Total number of returned events.
`hits.total.relation`:: `relation`::
+ +
-- --
(string) (string)
Indicates whether the number of documents returned is accurate or a lower bound. Indicates whether the number of events returned is accurate or a lower bound.
Returned values are: Returned values are:
`eq`::: Accurate `eq`::: Accurate
`gte`::: Lower bound, including returned documents `gte`::: Lower bound, including returned events
-- --
=====
`hits.events`:: `events`::
(array of objects) (array of objects)
Contains returned documents matching the query. Each object represents a Contains returned events matching the query. Each object represents a
matching document. matching event.
+
.Properties of `events` objects
[%collapsible%open]
=====
`hits.events._index`:: `_index`::
(string) (string)
Name of the index containing the returned document. Name of the index containing the returned event.
`hits.events._id`:: `_id`::
(string) (string)
Unique identifier for the returned document. (string)
Unique identifier for the returned event.
This ID is only unique within the returned index.
`hits.events._score`:: `_score`::
(float) (float)
Positive 32-bit floating point number indicating the relevance of the returned Positive 32-bit floating point number used to determine the relevance of the
document. See <<relevance-scores>>. returned event. See <<relevance-scores>>.
`hits.events._source`:: `_source`::
(object) (object)
Object containing the original JSON body passed for the document at index time. Original JSON body passed for the event at index time.
`hits.events.sort`:: `sort`::
(array) (array)
Integer used as the sort value for the event. Integer used as the sort value for the event.
+ +
By default, this is the event's <<eql-search-api-timestamp-field,timestamp By default, this is the event's <<eql-search-api-timestamp-field,timestamp
value>>, converted to milliseconds since the value>>, converted to milliseconds since the
https://en.wikipedia.org/wiki/Unix_time[Unix epoch]. https://en.wikipedia.org/wiki/Unix_time[Unix epoch].
=====
====
[[eql-search-api-example]] [[eql-search-api-example]]
==== {api-examples-title} ==== {api-examples-title}