Skip to main content
Server path: /elasticsearch-search | Type: Application | PCID required: Yes

​
Tools

ToolDescription
elasticsearch_search_async_search_deleteDelete an async search
elasticsearch_search_async_search_getGet async search results
elasticsearch_search_async_search_statusGet the async search status
elasticsearch_search_async_search_submitRun an async search
elasticsearch_search_bulkBulk index or delete documents
elasticsearch_search_clear_scrollClear a scrolling search
elasticsearch_search_close_point_in_timeClose a point in time
elasticsearch_search_countCount search results
elasticsearch_search_createCreate a new document in the index
elasticsearch_search_deleteDelete a document
elasticsearch_search_delete_by_queryDelete documents
elasticsearch_search_delete_by_query_rethrottleThrottle a delete by query operation
elasticsearch_search_esql_async_queryRun an async ES|QL query
elasticsearch_search_esql_async_query_deleteDelete an async ES|QL query
elasticsearch_search_esql_async_query_getGet async ES|QL query results
elasticsearch_search_esql_async_query_stopStop async ES|QL query
elasticsearch_search_esql_delete_viewDelete an ES|QL view
elasticsearch_search_esql_get_queryGet a specific running ES|QL query information
elasticsearch_search_esql_get_viewGet an ES|QL view
elasticsearch_search_esql_list_queriesGet running ES|QL queries information
elasticsearch_search_esql_put_viewCreate or update an ES|QL view
elasticsearch_search_esql_queryRun an ES|QL query
elasticsearch_search_explainExplain a document match result
elasticsearch_search_field_capsGet the field capabilities
elasticsearch_search_getGet a document by its ID
elasticsearch_search_get_sourceGet a document’s source
elasticsearch_search_indexCreate or update a document in an index
elasticsearch_search_mgetGet multiple documents
elasticsearch_search_msearchRun multiple searches
elasticsearch_search_msearch_templateRun multiple templated searches
elasticsearch_search_mtermvectorsGet multiple term vectors
elasticsearch_search_mvtSearch a vector tile
elasticsearch_search_open_point_in_timeOpen a point in time
elasticsearch_search_rank_evalEvaluate ranked search results
elasticsearch_search_reindexReindex documents
elasticsearch_search_reindex_rethrottleThrottle a reindex operation
elasticsearch_search_render_search_templateRender a search template
elasticsearch_search_scrollRun a scrolling search
elasticsearch_search_searchRun a search
elasticsearch_search_shardsGet the search shards
elasticsearch_search_templateRun a search with a search template
elasticsearch_search_terms_enumGet terms in an index
elasticsearch_search_termvectorsGet term vector information
elasticsearch_search_updateUpdate a document
elasticsearch_search_update_by_queryUpdate documents
elasticsearch_search_update_by_query_rethrottleThrottle an update by query operation

​
elasticsearch_search_async_search_delete

Delete an async search Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—A unique identifier for the async search.

​
elasticsearch_search_async_search_get

Get async search results Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—A unique identifier for the async search.
keep_alivestringNo—The length of time that the async search should be available in the cluster. When not specified, the keep_alive set with the corresponding submit async request will be used. Otherwise, it is possible to override the value and extend the validity of the request. When this period expires, the search, if still running, is cancelled. If the search is completed, its saved results are deleted.
typed_keysbooleanNo—Specify whether aggregation and suggester names should be prefixed by their respective types in the response
wait_for_completion_timeoutstringNo—Specifies to wait for the search to be completed up until the provided timeout. Final results will be returned if available before the timeout expires, otherwise the currently available results will be returned once the timeout expires. By default no timeout is set meaning that the currently available results will be returned without any additional wait.
return_intermediate_resultsbooleanNo—Specifies whether the response should contain intermediate results if the query is still running when the wait_for_completion_timeout expires or if no wait_for_completion_timeout is specified. If true and the search is still running, the search response will include any hits and partial aggregations that are available. If false and the search is still running, the search response will not include any hits (but possibly include total hits) nor will include any partial aggregations. When not specified, the intermediate results are returned for running queries.

​
elasticsearch_search_async_search_status

Get the async search status Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—A unique identifier for the async search.
keep_alivestringNo—The length of time that the async search needs to be available. Ongoing async searches and any saved search results are deleted after this period.

​
elasticsearch_search_async_search_submit

Run an async search Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of index names to search; use _all or empty string to perform the operation on all indices
wait_for_completion_timeoutstringNo—Blocks and waits until the search is completed up to a certain timeout. When the async search completes within the timeout, the response won’t include the ID as the results are not stored in the cluster.
keep_alivestringNo—Specifies how long the async search needs to be available. Ongoing async searches and any saved search results are deleted after this period.
keep_on_completionbooleanNo—If true, results are stored for later retrieval when the search completes within the wait_for_completion_timeout.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
allow_partial_search_resultsbooleanNo—Indicate if an error should be returned if there is a partial search failure or timeout
analyzerstringNo—The analyzer to use for the query string
analyze_wildcardbooleanNo—Specify whether wildcard and prefix queries should be analyzed
batched_reduce_sizenumberNo—Affects how often partial results become available, which happens whenever shard results are reduced. A partial reduction is performed every time the coordinating node has received a certain number of new shard responses (5 by default).
ccs_minimize_roundtripsbooleanNo—The default value is the only supported value.
default_operatorstringNo—The default operator for query string query (AND or OR)
dfstringNo—The field to use as default where no field prefix is given in the query string
docvalue_fieldsstring[]No—A comma-separated list of fields to return as the docvalue representation of a field for each hit
expand_wildcardsstring[]No—Whether to expand wildcard expression to concrete indices that are open, closed or both Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
explainbooleanNo—Specify whether to return detailed information about score computation as part of a hit
ignore_throttledbooleanNo—Whether specified concrete, expanded or aliased indices should be ignored when throttled
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
lenientbooleanNo—Specify whether format-based query failures (such as providing text to a numeric field) should be ignored
max_concurrent_shard_requestsnumberNo—The number of concurrent shard requests per node this search executes concurrently. This value should be used to limit the impact of the search on the cluster in order to limit the number of concurrent shard requests
preferencestringNo—Specify the node or shard the operation should be performed on
request_cachebooleanNo—Specify if request cache should be used for this request or not, defaults to true
routingstring[]No—A comma-separated list of specific routing values
search_typestringNo—Search operation type Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
statsstring[]No—Specific ‘tag’ of the request for logging and statistical purposes
stored_fieldsstring[]No—A comma-separated list of stored fields to return as part of a hit
suggest_fieldstringNo—Specifies which field to use for suggestions.
suggest_modestringNo—Specify suggest mode Supported values include: - missing: Only generate suggestions for terms that are not in the shard. - popular: Only suggest terms that occur in more docs on the shard than the original term. - always: Suggest any matching suggestions based on terms in the suggest text.
suggest_sizenumberNo—How many suggestions to return in response
suggest_textstringNo—The source text for which the suggestions should be returned.
terminate_afternumberNo—The maximum number of documents to collect for each shard, upon reaching which the query execution will terminate early
timeoutstringNo—Explicit operation timeout
track_total_hitsobjectNo—Indicate if the number of documents that match the query should be tracked. A number can also be specified, to accurately track the total hit count up to the number.
track_scoresbooleanNo—Whether to calculate and return scores even if they are not used for sorting
typed_keysbooleanNo—Specify whether aggregation and suggester names should be prefixed by their respective types in the response
rest_total_hits_as_intbooleanNo—Indicates whether hits.total should be rendered as an integer or an object in the rest search response
versionbooleanNo—Specify whether to return document version as part of a hit
_sourceobjectNo—True or false to return the _source field or not, or a list of fields to return
_source_excludesstring[]No—A list of fields to exclude from the returned _source field
_source_includesstring[]No—A list of fields to extract and return from the _source field
seq_no_primary_termbooleanNo—Specify whether to return sequence number and primary term of the last modification of each hit
qstringNo—Query in the Lucene query string syntax
sizenumberNo—Number of hits to return
fromnumberNo—Starting offset
sortstring[]No—A comma-separated list of <field>:<direction> pairs
aggregationsobjectNo—The aggregations value
collapseobjectNo—The collapse value
extobjectNo—Configuration of search extensions defined by Elasticsearch plugins.
fieldsobject[]No—Array of wildcard (*) patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.
highlightobjectNo—The highlight value
indices_boostobject[]No—Boosts the _score of documents from specified indices.
knnobject[]No—Defines the approximate kNN search to run.
min_scorenumberNo—Minimum _score for matching documents. Documents with a lower _score are not included in search results and results collected by aggregations.
pitobjectNo—Limits the search to a point in time (PIT). If you provide a PIT, you cannot specify an <index> in the request path.
post_filterobjectNo—Post Filter
profilebooleanNo—The profile value
queryobjectNo—Defines the search definition using the Query DSL.
rescoreobjectNo—The rescore value
runtime_mappingsobjectNo—Defines one or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
script_fieldsobjectNo—Retrieve a script evaluation (based on different fields) for each hit.
search_afterobjectNo—Search After
sliceobjectNo—The slice value
suggestobjectNo—The suggest value

​
elasticsearch_search_bulk

Bulk index or delete documents Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the data stream, index, or index alias to perform bulk actions on.
include_source_on_errorbooleanNo—True or false if to include the document source in the error message in case of parsing errors.
list_executed_pipelinesbooleanNo—If true, the response will include the ingest pipelines that were run for each index or create.
pipelinestringNo—The pipeline identifier to use to preprocess incoming documents. If the index has a default ingest pipeline specified, setting the value to _none turns off the default ingest pipeline for this request. If a final pipeline is configured, it will always run regardless of the value of this parameter.
refreshstringNo—If true, Elasticsearch refreshes the affected shards to make this operation visible to search. If wait_for, wait for a refresh to make this operation visible to search. If false, do nothing with refreshes. Valid values: true, false, wait_for.
routingstring[]No—A custom value that is used to route operations to a specific shard.
_sourceobjectNo—Indicates whether to return the _source field (true or false) or contains a list of fields to return.
_source_excludesstring[]No—A comma-separated list of source fields to exclude from the response. You can also use this parameter to exclude fields from the subset specified in _source_includes query parameter. If the _source parameter is false, this parameter is ignored.
_source_includesstring[]No—A comma-separated list of source fields to include in the response. If this parameter is specified, only these source fields are returned. You can exclude fields from this subset using the _source_excludes query parameter. If the _source parameter is false, this parameter is ignored.
timeoutstringNo—The period each action waits for the following operations: automatic index creation, dynamic mapping updates, and waiting for active shards. The default is 1m (one minute), which guarantees Elasticsearch waits for at least the timeout before failing. The actual wait time could be longer, particularly when multiple waits occur.
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. Set to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default is 1, which waits for each primary shard to be active.
require_aliasbooleanNo—If true, the request’s actions must target an index alias.
require_data_streambooleanNo—If true, the request’s actions must target a data stream (existing or to be created).
bodyany[]Yes—Request body

​
elasticsearch_search_clear_scroll

Clear a scrolling search Parameters:
ParameterTypeRequiredDefaultDescription
scroll_idstring[]Yes—A comma-separated list of scroll IDs to clear. To clear all scroll IDs, use _all. IMPORTANT: Scroll IDs can be long. It is recommended to specify scroll IDs in the request body parameter.

​
elasticsearch_search_close_point_in_time

Close a point in time Parameters:
ParameterTypeRequiredDefaultDescription
idobjectYes—The ID of the point-in-time.

​
elasticsearch_search_count

Count search results Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams and indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
analyzerstringNo—The analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.
analyze_wildcardbooleanNo—If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.
default_operatorstringNo—The default operator for query string query: and or or. This parameter can be used only when the q query string parameter is specified.
dfstringNo—The field to use as a default when no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
ignore_throttledbooleanNo—If true, concrete, expanded, or aliased indices are ignored when frozen.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
lenientbooleanNo—If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.
min_scorenumberNo—The minimum _score value that documents must have to be included in the result.
preferencestringNo—The node or shard the operation should be performed on. By default, it is random.
routingstring[]No—A custom value used to route operations to a specific shard.
terminate_afternumberNo—The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this parameter to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this parameter for requests that target data streams with backing indices across multiple data tiers.
qstringNo—The query in Lucene query string syntax. This parameter cannot be used with a request body.
queryobjectNo—Defines the search query using Query DSL. A request body query cannot be used with the q query string parameter.

​
elasticsearch_search_create

Create a new document in the index Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the data stream or index to target. If the target doesn’t exist and matches the name or wildcard (*) pattern of an index template with a data_stream definition, this request creates the data stream. If the target doesn’t exist and doesn’t match a data stream template, this request creates the index.
idstringYes—A unique identifier for the document. To automatically generate a document ID, use the POST /&lt;target&gt;/_doc/ request format.
include_source_on_errorbooleanNo—True or false if to include the document source in the error message in case of parsing errors.
pipelinestringNo—The ID of the pipeline to use to preprocess incoming documents. If the index has a default ingest pipeline specified, setting the value to _none turns off the default ingest pipeline for this request. If a final pipeline is configured, it will always run regardless of the value of this parameter.
refreshstringNo—If true, Elasticsearch refreshes the affected shards to make this operation visible to search. If wait_for, it waits for a refresh to make this operation visible to search. If false, it does nothing with refreshes.
require_aliasbooleanNo—If true, the destination must be an index alias.
require_data_streambooleanNo—If true, the request’s actions must target a data stream (existing or to be created).
routingstring[]No—A custom value that is used to route operations to a specific shard.
timeoutstringNo—The period the request waits for the following operations: automatic index creation, dynamic mapping updates, waiting for active shards. Elasticsearch waits for at least the specified timeout period before failing. The actual wait time could be longer, particularly when multiple waits occur. This parameter is useful for situations where the primary shard assigned to perform the operation might not be available when the operation runs. Some reasons for this might be that the primary shard is currently recovering from a gateway or undergoing relocation. By default, the operation will wait on the primary shard to become available for at least 1 minute before failing and responding with an error. The actual wait time could be longer, particularly when multiple waits occur.
versionnumberNo—The explicit version number for concurrency control. It must be a non-negative long number.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. You can set it to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default value of 1 means it waits for each primary shard to be active.
bodyobjectYes—Request body

​
elasticsearch_search_delete

Delete a document Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the target index.
idstringYes—A unique identifier for the document.
if_primary_termnumberNo—Only perform the operation if the document has this primary term.
if_seq_nonumberNo—Only perform the operation if the document has this sequence number.
refreshstringNo—If true, Elasticsearch refreshes the affected shards to make this operation visible to search. If wait_for, it waits for a refresh to make this operation visible to search. If false, it does nothing with refreshes.
routingstring[]No—A custom value used to route operations to a specific shard.
timeoutstringNo—The period to wait for active shards. This parameter is useful for situations where the primary shard assigned to perform the delete operation might not be available when the delete operation runs. Some reasons for this might be that the primary shard is currently recovering from a store or undergoing relocation. By default, the delete operation will wait on the primary shard to become available for up to 1 minute before failing and responding with an error.
versionnumberNo—An explicit version number for concurrency control. It must match the current version of the document for the request to succeed.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.
wait_for_active_shardsobjectNo—The minimum number of shard copies that must be active before proceeding with the operation. You can set it to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default value of 1 means it waits for each primary shard to be active.

​
elasticsearch_search_delete_by_query

Delete documents Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams or indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
analyzerstringNo—Analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.
analyze_wildcardbooleanNo—If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.
conflictsstringNo—What to do if delete by query hits version conflicts: abort or proceed. Supported values include: - abort: Stop reindexing if there are conflicts. - proceed: Continue reindexing even if there are conflicts.
default_operatorstringNo—The default operator for query string query: and or or. This parameter can be used only when the q query string parameter is specified.
dfstringNo—The field to use as default where no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
fromnumberNo—Skips the specified number of documents.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
lenientbooleanNo—If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.
max_docsnumberNo—The maximum number of documents to process. Defaults to all documents. When set to a value less then or equal to scroll_size, a scroll will not be used to retrieve the results for the operation.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
refreshbooleanNo—If true, Elasticsearch refreshes all shards involved in the delete by query after the request completes. This is different than the delete API’s refresh parameter, which causes just the shard that received the delete request to be refreshed. Unlike the delete API, it does not support wait_for.
request_cachebooleanNo—If true, the request cache is used for this request. Defaults to the index-level setting.
requests_per_secondnumberNo—The throttle for this request in sub-requests per second.
routingstring[]No—A custom value used to route operations to a specific shard.
qstringNo—A query in the Lucene query string syntax.
scrollstringNo—The period to retain the search context for scrolling.
scroll_sizenumberNo—The size of the scroll request that powers the operation.
search_timeoutstringNo—The explicit timeout for each search request. It defaults to no timeout.
search_typestringNo—The type of the search operation. Available options include query_then_fetch and dfs_query_then_fetch. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
slicesobjectNo—The number of slices this task should be divided into.
sortstring[]No—A comma-separated list of &lt;field&gt;:&lt;direction&gt; pairs.
statsstring[]No—The specific tag of the request for logging and statistical purposes.
terminate_afternumberNo—The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. Use with caution. Elasticsearch applies this parameter to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this parameter for requests that target data streams with backing indices across multiple data tiers.
timeoutstringNo—The period each deletion request waits for active shards.
versionbooleanNo—If true, returns the document version as part of a hit.
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. Set to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The timeout value controls how long each write request waits for unavailable shards to become available.
wait_for_completionbooleanNo—If true, the request blocks until the operation is complete. If false, Elasticsearch performs some preflight checks, launches the request, and returns a task you can use to cancel or get the status of the task. Elasticsearch creates a record of this task as a document at .tasks/task/$&#123;taskId&#125;. When you are done with a task, you should delete the task document so Elasticsearch can reclaim the space.
queryobjectNo—The documents to delete specified with Query DSL.
sliceobjectNo—Slice the request manually using the provided slice ID and total number of slices.

​
elasticsearch_search_delete_by_query_rethrottle

Throttle a delete by query operation Parameters:
ParameterTypeRequiredDefaultDescription
task_idstringYes—The ID for the task.
requests_per_secondnumberYes—The throttle for this request in sub-requests per second. To disable throttling, set it to -1.

​
elasticsearch_search_esql_async_query

Run an async ES|QL query Parameters:
ParameterTypeRequiredDefaultDescription
allow_partial_resultsbooleanNo—If true, partial results will be returned if there are shard failures, but the query can continue to execute on other clusters and shards. If false, the query will fail if there are any failures. To override the default behavior, you can set the esql.query.allow_partial_results cluster setting to false.
delimiterstringNo—The character to use between values within a CSV row. It is valid only for the CSV format.
drop_null_columnsbooleanNo—Indicates whether columns that are entirely null will be removed from the columns and values portion of the results. If true, the response will include an extra section under the name all_columns which has the name of all the columns.
formatstringNo—A short version of the Accept header, e.g. json, yaml. csv, tsv, and txt formats will return results in a tabular format, excluding other metadata fields from the response. For async requests, nothing will be returned if the async query doesn’t finish within the timeout. The query ID and running status are available in the X-Elasticsearch-Async-Id and X-Elasticsearch-Async-Is-Running HTTP headers of the response, respectively.
columnarbooleanNo—By default, ES|QL returns results as rows. For example, FROM returns each individual document as one row. For the JSON, YAML, CBOR and smile formats, ES|QL can return the results in a columnar fashion where one row represents all the values of a certain column in the results.
filterobjectNo—Specify a Query DSL query in the filter parameter to filter the set of documents that an ES|QL query runs on.
include_ccs_metadatabooleanNo—When set to true and performing a cross-cluster/cross-project query, the response will include an extra _clusters object with information about the clusters that participated in the search along with info such as shards count.
include_execution_metadatabooleanNo—When set to true, the response will include an extra _clusters object with information about the clusters that participated in the search along with info such as shards count. This is similar to include_ccs_metadata, but it also returns metadata when the query is not CCS/CPS
keep_aliveobjectNo—The period for which the query and its results are stored in the cluster. The default period is five days. When this period expires, the query and its results are deleted, even if the query is still ongoing. If the keep_on_completion parameter is false, Elasticsearch only stores async queries that do not complete within the period set by the wait_for_completion_timeout parameter, regardless of this value.
keep_on_completionbooleanNo—Indicates whether the query and its results are stored in the cluster. If false, the query and its results are stored in the cluster only if the request does not complete during the period set by the wait_for_completion_timeout parameter.
localestringNo—Returns results (especially dates) formatted per the conventions of the locale.
paramsobjectNo—To avoid any attempts of hacking or code injection, extract the values in a separate list of parameters. Use question mark placeholders (?) in the query string for each of the parameters.
profilebooleanNo—If provided and true the response will include an extra profile object with information on how the query was executed. This information is for human debugging and its format can change at any time but it can give some insight into the performance of each part of the query.
querystringYes—The ES|QL query API accepts an ES|QL query string in the query parameter, runs it, and returns the results.
tablesobjectNo—Tables to use with the LOOKUP operation. The top level key is the table name and the next level key is the column name.
time_zonestringNo—Sets the default timezone of the query.
wait_for_completion_timeoutobjectNo—The period to wait for the request to finish. By default, the request waits for 1 second for the query results. If the query completes during this period, results are returned Otherwise, a query ID is returned that can later be used to retrieve the results.

​
elasticsearch_search_esql_async_query_delete

Delete an async ES|QL query Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—The unique identifier of the query. A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time. A query ID is also provided when the request was submitted with the keep_on_completion parameter set to true.

​
elasticsearch_search_esql_async_query_get

Get async ES|QL query results Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—The unique identifier of the query. A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time. A query ID is also provided when the request was submitted with the keep_on_completion parameter set to true.
drop_null_columnsbooleanNo—Indicates whether columns that are entirely null will be removed from the columns and values portion of the results. If true, the response will include an extra section under the name all_columns which has the name of all the columns.
formatstringNo—A short version of the Accept header, for example json or yaml.
keep_alivestringNo—The period for which the query and its results are stored in the cluster. When this period expires, the query and its results are deleted, even if the query is still ongoing.
wait_for_completion_timeoutstringNo—The period to wait for the request to finish. By default, the request waits for complete query results. If the request completes during the period specified in this parameter, complete query results are returned. Otherwise, the response returns an is_running value of true and no results.

​
elasticsearch_search_esql_async_query_stop

Stop async ES|QL query Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—The unique identifier of the query. A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time. A query ID is also provided when the request was submitted with the keep_on_completion parameter set to true.
drop_null_columnsbooleanNo—Indicates whether columns that are entirely null will be removed from the columns and values portion of the results. If true, the response will include an extra section under the name all_columns which has the name of all the columns.

​
elasticsearch_search_esql_delete_view

Delete an ES|QL view Parameters:
ParameterTypeRequiredDefaultDescription
namestringYes—The view name to remove.

​
elasticsearch_search_esql_get_query

Get a specific running ES|QL query information Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—The query ID

​
elasticsearch_search_esql_get_view

Get an ES|QL view Parameters:
ParameterTypeRequiredDefaultDescription
namestringYes—The comma-separated view names to retrieve.

​
elasticsearch_search_esql_list_queries

Get running ES|QL queries information

​
elasticsearch_search_esql_put_view

Create or update an ES|QL view Parameters:
ParameterTypeRequiredDefaultDescription
namestringYes—The view name to create or update.
querystringYes—The ES|QL query string from which to create a view.

​
elasticsearch_search_esql_query

Run an ES|QL query Parameters:
ParameterTypeRequiredDefaultDescription
formatstringNo—A short version of the Accept header, e.g. json, yaml. csv, tsv, and txt formats will return results in a tabular format, excluding other metadata fields from the response.
delimiterstringNo—The character to use between values within a CSV row. Only valid for the CSV format.
drop_null_columnsbooleanNo—Should columns that are entirely null be removed from the columns and values portion of the results? Defaults to false. If true then the response will include an extra section under the name all_columns which has the name of all columns.
allow_partial_resultsbooleanNo—If true, partial results will be returned if there are shard failures, but the query can continue to execute on other clusters and shards. If false, the query will fail if there are any failures. To override the default behavior, you can set the esql.query.allow_partial_results cluster setting to false.
columnarbooleanNo—By default, ES|QL returns results as rows. For example, FROM returns each individual document as one row. For the JSON, YAML, CBOR and smile formats, ES|QL can return the results in a columnar fashion where one row represents all the values of a certain column in the results.
filterobjectNo—Specify a Query DSL query in the filter parameter to filter the set of documents that an ES|QL query runs on.
include_ccs_metadatabooleanNo—When set to true and performing a cross-cluster/cross-project query, the response will include an extra _clusters object with information about the clusters that participated in the search along with info such as shards count.
include_execution_metadatabooleanNo—When set to true, the response will include an extra _clusters object with information about the clusters that participated in the search along with info such as shards count. This is similar to include_ccs_metadata, but it also returns metadata when the query is not CCS/CPS
localestringNo—Returns results (especially dates) formatted per the conventions of the locale.
paramsobjectNo—To avoid any attempts of hacking or code injection, extract the values in a separate list of parameters. Use question mark placeholders (?) in the query string for each of the parameters.
profilebooleanNo—If provided and true the response will include an extra profile object with information on how the query was executed. This information is for human debugging and its format can change at any time but it can give some insight into the performance of each part of the query.
querystringYes—The ES|QL query API accepts an ES|QL query string in the query parameter, runs it, and returns the results.
tablesobjectNo—Tables to use with the LOOKUP operation. The top level key is the table name and the next level key is the column name.
time_zonestringNo—Sets the default timezone of the query.

​
elasticsearch_search_explain

Explain a document match result Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—Index names that are used to limit the request. Only a single index name can be provided to this parameter.
idstringYes—The document identifier.
analyzerstringNo—The analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.
analyze_wildcardbooleanNo—If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.
default_operatorstringNo—The default operator for query string query: and or or. This parameter can be used only when the q query string parameter is specified.
dfstringNo—The field to use as default where no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.
lenientbooleanNo—If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
routingstring[]No—A custom value used to route operations to a specific shard.
_sourceobjectNo—True or false to return the _source field or not or a list of fields to return.
_source_excludesstring[]No—A comma-separated list of source fields to exclude from the response. You can also use this parameter to exclude fields from the subset specified in _source_includes query parameter. If the _source parameter is false, this parameter is ignored.
_source_includesstring[]No—A comma-separated list of source fields to include in the response. If this parameter is specified, only these source fields are returned. You can exclude fields from this subset using the _source_excludes query parameter. If the _source parameter is false, this parameter is ignored.
stored_fieldsstring[]No—A comma-separated list of stored fields to return in the response.
qstringNo—The query in the Lucene query string syntax.
queryobjectNo—Defines the search definition using the Query DSL.

​
elasticsearch_search_field_caps

Get the field capabilities Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
fieldsstring[]No—A comma-separated list of fields to retrieve capabilities for. Wildcard (*) expressions are supported.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
include_unmappedbooleanNo—If true, unmapped fields are included in the response.
filtersstring[]No—A comma-separated list of filters to apply to the response.
typesstring[]No—A comma-separated list of field types to include. Any fields that do not match one of these types will be excluded from the results. It defaults to empty, meaning that all field types are returned.
include_empty_fieldsbooleanNo—If false, empty fields are not included in the response.
index_filterobjectNo—Filter indices if the provided query rewrites to match_none on every shard. IMPORTANT: The filtering is done on a best-effort basis, it uses index statistics and mappings to rewrite queries to match_none instead of fully running the request. For instance a range query over a date field can rewrite to match_none if all documents within a shard (including deleted documents) are outside of the provided range. However, not all queries can rewrite to match_none so this API may return an index even if the provided filter matches no document.
runtime_mappingsobjectNo—Define ad-hoc runtime fields in the request similar to the way it is done in search requests. These fields exist only as part of the query and take precedence over fields defined with the same name in the index mappings.

​
elasticsearch_search_get

Get a document by its ID Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the index that contains the document.
idstringYes—A unique document identifier.
preferencestringNo—The node or shard the operation should be performed on. By default, the operation is randomized between the shard replicas. If it is set to _local, the operation will prefer to be run on a local allocated shard when possible. If it is set to a custom value, the value is used to guarantee that the same shards will be used for the same custom value. This can help with “jumping values” when hitting different shards in different refresh states. A sample value can be something like the web session ID or the user name.
realtimebooleanNo—If true, the request is real-time as opposed to near-real-time.
refreshbooleanNo—If true, the request refreshes the relevant shards before retrieving the document. Setting it to true should be done after careful thought and verification that this does not cause a heavy load on the system (and slow down indexing).
routingstring[]No—A custom value used to route operations to a specific shard.
_sourceobjectNo—Indicates whether to return the _source field (true or false) or lists the fields to return.
_source_excludesstring[]No—A comma-separated list of source fields to exclude from the response. You can also use this parameter to exclude fields from the subset specified in _source_includes query parameter. If the _source parameter is false, this parameter is ignored.
_source_exclude_vectorsbooleanNo—Whether vectors should be excluded from _source
_source_includesstring[]No—A comma-separated list of source fields to include in the response. If this parameter is specified, only these source fields are returned. You can exclude fields from this subset using the _source_excludes query parameter. If the _source parameter is false, this parameter is ignored.
stored_fieldsstring[]No—A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the _source parameter defaults to false. Only leaf fields can be retrieved with the stored_fields option. Object fields can’t be returned; if specified, the request fails.
versionnumberNo—The version number for concurrency control. It must match the current version of the document for the request to succeed.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.

​
elasticsearch_search_get_source

Get a document’s source Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the index that contains the document.
idstringYes—A unique document identifier.
preferencestringNo—The node or shard the operation should be performed on. By default, the operation is randomized between the shard replicas.
realtimebooleanNo—If true, the request is real-time as opposed to near-real-time.
refreshbooleanNo—If true, the request refreshes the relevant shards before retrieving the document. Setting it to true should be done after careful thought and verification that this does not cause a heavy load on the system (and slow down indexing).
routingstring[]No—A custom value used to route operations to a specific shard.
_sourceobjectNo—Indicates whether to return the _source field (true or false) or lists the fields to return.
_source_excludesstring[]No—A comma-separated list of source fields to exclude in the response.
_source_includesstring[]No—A comma-separated list of source fields to include in the response.
versionnumberNo—The version number for concurrency control. It must match the current version of the document for the request to succeed.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.

​
elasticsearch_search_index

Create or update a document in an index Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the data stream or index to target. If the target doesn’t exist and matches the name or wildcard (*) pattern of an index template with a data_stream definition, this request creates the data stream. If the target doesn’t exist and doesn’t match a data stream template, this request creates the index. You can check for existing targets with the resolve index API.
idstringYes—A unique identifier for the document. To automatically generate a document ID, use the POST /&lt;target&gt;/_doc/ request format and omit this parameter.
if_primary_termnumberNo—Only perform the operation if the document has this primary term.
if_seq_nonumberNo—Only perform the operation if the document has this sequence number.
include_source_on_errorbooleanNo—True or false if to include the document source in the error message in case of parsing errors.
op_typestringNo—Set to create to only index the document if it does not already exist (put if absent). If a document with the specified _id already exists, the indexing operation will fail. The behavior is the same as using the &lt;index&gt;/_create endpoint. If a document ID is specified, this paramater defaults to index. Otherwise, it defaults to create. If the request targets a data stream, an op_type of create is required. Supported values include: - index: Overwrite any documents that already exist. - create: Only index documents that do not already exist.
pipelinestringNo—The ID of the pipeline to use to preprocess incoming documents. If the index has a default ingest pipeline specified, then setting the value to _none disables the default ingest pipeline for this request. If a final pipeline is configured it will always run, regardless of the value of this parameter.
refreshstringNo—If true, Elasticsearch refreshes the affected shards to make this operation visible to search. If wait_for, it waits for a refresh to make this operation visible to search. If false, it does nothing with refreshes.
routingstring[]No—A custom value that is used to route operations to a specific shard.
timeoutstringNo—The period the request waits for the following operations: automatic index creation, dynamic mapping updates, waiting for active shards. This parameter is useful for situations where the primary shard assigned to perform the operation might not be available when the operation runs. Some reasons for this might be that the primary shard is currently recovering from a gateway or undergoing relocation. By default, the operation will wait on the primary shard to become available for at least 1 minute before failing and responding with an error. The actual wait time could be longer, particularly when multiple waits occur.
versionnumberNo—An explicit version number for concurrency control. It must be a non-negative long number.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. You can set it to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default value of 1 means it waits for each primary shard to be active.
require_aliasbooleanNo—If true, the destination must be an index alias.
require_data_streambooleanNo—If true, the request’s actions must target a data stream (existing or to be created).
bodyobjectYes—Request body

​
elasticsearch_search_mget

Get multiple documents Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—Name of the index to retrieve documents from when ids are specified, or when a document in the docs array does not specify an index.
preferencestringNo—Specifies the node or shard the operation should be performed on. Random by default.
realtimebooleanNo—If true, the request is real-time as opposed to near-real-time.
refreshbooleanNo—If true, the request refreshes relevant shards before retrieving documents.
routingstring[]No—Custom value used to route operations to a specific shard.
_sourceobjectNo—True or false to return the _source field or not, or a list of fields to return.
_source_excludesstring[]No—A comma-separated list of source fields to exclude from the response. You can also use this parameter to exclude fields from the subset specified in _source_includes query parameter.
_source_includesstring[]No—A comma-separated list of source fields to include in the response. If this parameter is specified, only these source fields are returned. You can exclude fields from this subset using the _source_excludes query parameter. If the _source parameter is false, this parameter is ignored.
stored_fieldsstring[]No—If true, retrieves the document fields stored in the index rather than the document _source.
docsobject[]No—The documents you want to retrieve. Required if no index is specified in the request URI.
idsobjectNo—The IDs of the documents you want to retrieve. Allowed when the index is specified in the request URI.

​
elasticsearch_search_msearch

Run multiple searches Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—Comma-separated list of data streams, indices, and index aliases to search.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
ccs_minimize_roundtripsbooleanNo—If true, network roundtrips between the coordinating node and remote clusters are minimized for cross-cluster search requests.
expand_wildcardsstring[]No—Type of index that wildcard expressions can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
ignore_throttledbooleanNo—If true, concrete, expanded or aliased indices are ignored when frozen.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
include_named_queries_scorebooleanNo—Indicates whether hit.matched_queries should be rendered as a map that includes the name of the matched query associated with its score (true) or as an array containing the name of the matched queries (false) This functionality reruns each named query on every hit in a search response. Typically, this adds a small overhead to a request. However, using computationally expensive named queries on a large number of hits may add significant overhead.
max_concurrent_searchesnumberNo—Maximum number of concurrent searches the multi search API can execute. Defaults to max(1, (# of data nodes * min(search thread pool size, 10))).
max_concurrent_shard_requestsnumberNo—Maximum number of concurrent shard requests that each sub-search request executes per node.
pre_filter_shard_sizenumberNo—Defines a threshold that enforces a pre-filter roundtrip to prefilter search shards based on query rewriting if the number of shards the search request expands to exceeds the threshold. This filter roundtrip can limit the number of shards significantly if for instance a shard can not match any documents based on its rewrite method i.e., if date filters are mandatory to match but the shard bounds and the query are disjoint.
rest_total_hits_as_intbooleanNo—If true, hits.total are returned as an integer in the response. Defaults to false, which returns an object.
routingstring[]No—Custom routing value used to route search operations to a specific shard.
search_typestringNo—Indicates whether global term and document frequencies should be used when scoring returned documents. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
typed_keysbooleanNo—Specifies whether aggregation and suggester names should be prefixed by their respective types in the response.
bodyany[]Yes—Request body

​
elasticsearch_search_msearch_template

Run multiple templated searches Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams and indices, omit this parameter or use *.
ccs_minimize_roundtripsbooleanNo—If true, network round-trips are minimized for cross-cluster search requests.
max_concurrent_searchesnumberNo—The maximum number of concurrent searches the API can run.
search_typestringNo—The type of the search operation. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
rest_total_hits_as_intbooleanNo—If true, the response returns hits.total as an integer. If false, it returns hits.total as an object.
typed_keysbooleanNo—If true, the response prefixes aggregation and suggester names with their respective types.
bodyany[]Yes—Request body

​
elasticsearch_search_mtermvectors

Get multiple term vectors Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the index that contains the documents.
idsstring[]No—A comma-separated list of documents ids. You must define ids as parameter or set “ids” or “docs” in the request body
fieldsstring[]No—A comma-separated list or wildcard expressions of fields to include in the statistics. It is used as the default list unless a specific field list is provided in the completion_fields or fielddata_fields parameters.
field_statisticsbooleanNo—If true, the response includes the document count, sum of document frequencies, and sum of total term frequencies.
offsetsbooleanNo—If true, the response includes term offsets.
payloadsbooleanNo—If true, the response includes term payloads.
positionsbooleanNo—If true, the response includes term positions.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
realtimebooleanNo—If true, the request is real-time as opposed to near-real-time.
routingstring[]No—A custom value used to route operations to a specific shard.
term_statisticsbooleanNo—If true, the response includes term frequency and document frequency.
versionnumberNo—If true, returns the document version as part of a hit.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.
docsobject[]No—An array of existing or artificial documents.

​
elasticsearch_search_mvt

Search a vector tile Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A list of indices, data streams, or aliases to search. It supports wildcards (*). To search all data streams and indices, omit this parameter or use * or _all. To search a remote cluster, use the &lt;cluster&gt;:&lt;target&gt; syntax.
fieldstringYes—A field that contains the geospatial data to return. It must be a geo_point or geo_shape field. The field must have doc values enabled. It cannot be a nested field. NOTE: Vector tiles do not natively support geometry collections. For geometrycollection values in a geo_shape field, the API returns a hits layer feature for each element of the collection. This behavior may change in a future release.
zoomnumberYes—The zoom level of the vector tile to search. It accepts 0 to 29.
xnumberYes—The X coordinate for the vector tile to search.
ynumberYes—The Y coordinate for the vector tile to search.
exact_boundsbooleanNo—If false, the meta layer’s feature is the bounding box of the tile. If true, the meta layer’s feature is a bounding box resulting from a geo_bounds aggregation. The aggregation runs on <field> values that intersect the <zoom>/<x>/<y> tile with wrap_longitude set to false. The resulting bounding box may be larger than the vector tile.
extentnumberNo—The size, in pixels, of a side of the tile. Vector tiles are square with equal sides.
grid_aggstringNo—Aggregation used to create a grid for field.
grid_precisionnumberNo—Additional zoom levels available through the aggs layer. For example, if <zoom> is 7 and grid_precision is 8, you can zoom in up to level 15. Accepts 0-8. If 0, results don’t include the aggs layer.
grid_typestringNo—Determines the geometry type for features in the aggs layer. In the aggs layer, each feature represents a geotile_grid cell. If ‘grid’ each feature is a Polygon of the cells bounding box. If ‘point’ each feature is a Point that is the centroid of the cell.
sizenumberNo—Maximum number of features to return in the hits layer. Accepts 0-10000. If 0, results don’t include the hits layer.
track_total_hitsobjectNo—The number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query.
with_labelsbooleanNo—If true, the hits and aggs layers will contain additional point features representing suggested label positions for the original features. * Point and MultiPoint features will have one of the points selected. * Polygon and MultiPolygon features will have a single point generated, either the centroid, if it is within the polygon, or another point within the polygon selected from the sorted triangle-tree. * LineString features will likewise provide a roughly central point selected from the triangle-tree. * The aggregation results will provide one central point for each aggregation bucket. All attributes from the original features will also be copied to the new label features. In addition, the new features will be distinguishable using the tag _mvt_label_position.
aggsobjectNo—Sub-aggregations for the geotile_grid. It supports the following aggregation types: - avg - boxplot - cardinality - extended stats - max - median absolute deviation - min - percentile - percentile-rank - stats - sum - value count The aggregation names can’t start with _mvt_. The _mvt_ prefix is reserved for internal aggregations.
buffernumberNo—The size, in pixels, of a clipping buffer outside the tile. This allows renderers to avoid outline artifacts from geometries that extend past the extent of the tile.
fieldsobjectNo—The fields to return in the hits layer. It supports wildcards (*). This parameter does not support fields with array values. Fields with array values may return inconsistent results.
queryobjectNo—The query DSL used to filter documents for the search.
runtime_mappingsobjectNo—Defines one or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
sortobjectNo—Sort the features in the hits layer. By default, the API calculates a bounding box for each feature. It sorts features based on this box’s diagonal length, from longest to shortest.

​
elasticsearch_search_open_point_in_time

Open a point in time Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of index names to open point in time; use _all or empty string to perform the operation on all indices
keep_alivestringYes—Extend the length of time that the point in time persists.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
preferencestringNo—The node or shard the operation should be performed on. By default, it is random.
routingstring[]No—A custom value that is used to route operations to a specific shard.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
allow_partial_search_resultsbooleanNo—Indicates whether the point in time tolerates unavailable shards or shard failures when initially creating the PIT. If false, creating a point in time request when a shard is missing or unavailable will throw an exception. If true, the point in time will contain all the shards that are available at the time of the request.
max_concurrent_shard_requestsnumberNo—Maximum number of concurrent shard requests that each sub-search request executes per node.
index_filterobjectNo—Filter indices if the provided query rewrites to match_none on every shard.

​
elasticsearch_search_rank_eval

Evaluate ranked search results Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and index aliases used to limit the request. Wildcard (*) expressions are supported. To target all data streams and indices in a cluster, omit this parameter or use _all or *.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
expand_wildcardsstring[]No—Whether to expand wildcard expression to concrete indices that are open, closed or both. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
search_typestringNo—Search operation type Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
metricobjectNo—Definition of the evaluation metric to calculate.
requestsobject[]Yes—A set of typical search requests, together with their provided ratings.

​
elasticsearch_search_reindex

Reindex documents Parameters:
ParameterTypeRequiredDefaultDescription
refreshbooleanNo—If true, the request refreshes affected shards to make this operation visible to search.
requests_per_secondnumberNo—The throttle for this request in sub-requests per second. By default, there is no throttle.
scrollstringNo—The period of time that a consistent view of the index should be maintained for scrolled search.
slicesobjectNo—The number of slices this task should be divided into. It defaults to one slice, which means the task isn’t sliced into subtasks. Reindex supports sliced scroll to parallelize the reindexing process. This parallelization can improve efficiency and provide a convenient way to break the request down into smaller parts. NOTE: Reindexing from remote clusters does not support manual or automatic slicing. If set to auto, Elasticsearch chooses the number of slices to use. This setting will use one slice per shard, up to a certain limit. If there are multiple sources, it will choose the number of slices based on the index or backing index with the smallest number of shards.
max_docsnumberNo—The maximum number of documents to reindex. By default, all documents are reindexed. If it is a value less then or equal to scroll_size, a scroll will not be used to retrieve the results for the operation. If conflicts is set to proceed, the reindex operation could attempt to reindex more documents from the source than max_docs until it has successfully indexed max_docs documents into the target or it has gone through every document in the source query.
timeoutstringNo—The period each indexing waits for automatic index creation, dynamic mapping updates, and waiting for active shards. By default, Elasticsearch waits for at least one minute before failing. The actual wait time could be longer, particularly when multiple waits occur.
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. Set it to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default value is one, which means it waits for each primary shard to be active.
wait_for_completionbooleanNo—If true, the request blocks until the operation is complete.
require_aliasbooleanNo—If true, the destination must be an index alias.
conflictsobjectNo—Indicates whether to continue reindexing even when there are conflicts. Supported values include: - abort: Stop reindexing if there are conflicts. - proceed: Continue reindexing even if there are conflicts.
destobjectYes—The destination you are copying to.
scriptobjectNo—The script to run to update the document source or metadata when reindexing.
sourceobjectYes—The source you are copying from.

​
elasticsearch_search_reindex_rethrottle

Throttle a reindex operation Parameters:
ParameterTypeRequiredDefaultDescription
task_idstringYes—The task identifier, which can be found by using the tasks API.
requests_per_secondnumberYes—The throttle for this request in sub-requests per second. It can be either -1 to turn off throttling or any decimal number like 1.7 or 12 to throttle to that level.
group_bystringNo—Supported values include: - nodes: Group tasks by node ID. - parents: Group tasks by parent task ID. - none: Do not group tasks.

​
elasticsearch_search_render_search_template

Render a search template Parameters:
ParameterTypeRequiredDefaultDescription
idstringYes—The ID of the search template to render. If no source is specified, this or the id request body parameter is required.
filestringNo—The file value
paramsobjectNo—Key-value pairs used to replace Mustache variables in the template. The key is the variable name. The value is the variable value.
sourceobjectNo—An inline search template. It supports the same parameters as the search API’s request body. These parameters also support Mustache variables. If no id or &lt;templated-id&gt; is specified, this parameter is required.

​
elasticsearch_search_scroll

Run a scrolling search Parameters:
ParameterTypeRequiredDefaultDescription
scroll_idstringYes—The scroll ID
scrollstringNo—The period to retain the search context for scrolling.
rest_total_hits_as_intbooleanNo—If true, the API response’s hit.total property is returned as an integer. If false, the API response’s hit.total property is returned as an object.
Run a search Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams and indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
allow_partial_search_resultsbooleanNo—If true and there are shard request timeouts or shard failures, the request returns partial results. If false, it returns an error with no partial results. To override the default behavior, you can set the search.default_allow_partial_results cluster setting to false.
analyzerstringNo—The analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.
analyze_wildcardbooleanNo—If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.
batched_reduce_sizenumberNo—The number of shard results that should be reduced at once on the coordinating node. If the potential number of shards in the request can be large, this value should be used as a protection mechanism to reduce the memory overhead per search request.
ccs_minimize_roundtripsbooleanNo—If true, network round-trips between the coordinating node and the remote clusters are minimized when running cross-cluster search (CCS) requests.
default_operatorstringNo—The default operator for the query string query: and or or. This parameter can be used only when the q query string parameter is specified.
dfstringNo—The field to use as a default when no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.
docvalue_fieldsstring[]No—A comma-separated list of fields to return as the docvalue representation of a field for each hit.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
explainbooleanNo—If true, the request returns detailed information about score computation as part of a hit.
ignore_throttledbooleanNo—If true, concrete, expanded or aliased indices will be ignored when frozen.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
include_named_queries_scorebooleanNo—If true, the response includes the score contribution from any named queries. This functionality reruns each named query on every hit in a search response. Typically, this adds a small overhead to a request. However, using computationally expensive named queries on a large number of hits may add significant overhead.
lenientbooleanNo—If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.
max_concurrent_shard_requestsnumberNo—The number of concurrent shard requests per node that the search runs concurrently. This value should be used to limit the impact of the search on the cluster in order to limit the number of concurrent shard requests.
preferencestringNo—The nodes and shards used for the search. By default, Elasticsearch selects from eligible nodes and shards using adaptive replica selection, accounting for allocation awareness. Valid values are: * _only_local to run the search only on shards on the local node. * _local to, if possible, run the search on shards on the local node, or if not, select shards using the default method. * _only_nodes:&lt;node-id&gt;,&lt;node-id&gt; to run the search on only the specified nodes IDs. If suitable shards exist on more than one selected node, use shards on those nodes using the default method. If none of the specified nodes are available, select shards from any available node using the default method. * _prefer_nodes:&lt;node-id&gt;,&lt;node-id&gt; to if possible, run the search on the specified nodes IDs. If not, select shards using the default method. * _shards:&lt;shard&gt;,&lt;shard&gt; to run the search only on the specified shards. You can combine this value with other preference values. However, the _shards value must come first. For example: _shards:2,3|_local. * &lt;custom-string&gt; (any string that does not start with _) to route searches with the same &lt;custom-string&gt; to the same shards in the same order.
pre_filter_shard_sizenumberNo—A threshold that enforces a pre-filter roundtrip to prefilter search shards based on query rewriting if the number of shards the search request expands to exceeds the threshold. This filter roundtrip can limit the number of shards significantly if for instance a shard can not match any documents based on its rewrite method (if date filters are mandatory to match but the shard bounds and the query are disjoint). When unspecified, the pre-filter phase is executed if any of these conditions is met: * The request targets more than 128 shards. * The request targets one or more read-only index. * The primary sort of the query targets an indexed field.
request_cachebooleanNo—If true, the caching of search results is enabled for requests where size is 0. It defaults to index level settings.
routingstring[]No—A custom value that is used to route operations to a specific shard.
scrollstringNo—The period to retain the search context for scrolling. By default, this value cannot exceed 1d (24 hours). You can change this limit by using the search.max_keep_alive cluster-level setting.
search_typestringNo—Indicates how distributed term frequencies are calculated for relevance scoring. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
statsstring[]No—Specific tag of the request for logging and statistical purposes.
stored_fieldsstring[]No—A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the _source parameter defaults to false. You can pass _source: true to return both source fields and stored fields in the search response.
suggest_fieldstringNo—The field to use for suggestions.
suggest_modestringNo—The suggest mode. This parameter can be used only when the suggest_field and suggest_text query string parameters are specified. Supported values include: - missing: Only generate suggestions for terms that are not in the shard. - popular: Only suggest terms that occur in more docs on the shard than the original term. - always: Suggest any matching suggestions based on terms in the suggest text.
suggest_sizenumberNo—The number of suggestions to return. This parameter can be used only when the suggest_field and suggest_text query string parameters are specified.
suggest_textstringNo—The source text for which the suggestions should be returned. This parameter can be used only when the suggest_field and suggest_text query string parameters are specified.
terminate_afternumberNo—The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this parameter to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this parameter for requests that target data streams with backing indices across multiple data tiers. If set to 0 (default), the query does not terminate early.
timeoutstringNo—The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. It defaults to no timeout.
track_total_hitsobjectNo—The number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query.
track_scoresbooleanNo—If true, the request calculates and returns document scores, even if the scores are not used for sorting.
typed_keysbooleanNo—If true, aggregation and suggester names are be prefixed by their respective types in the response.
rest_total_hits_as_intbooleanNo—Indicates whether hits.total should be rendered as an integer or an object in the rest search response.
versionbooleanNo—If true, the request returns the document version as part of a hit.
_sourceobjectNo—The source fields that are returned for matching documents. These fields are returned in the hits._source property of the search response. Valid values are: * true to return the entire document source. * false to not return the document source. * &lt;string&gt; to return the source fields that are specified as a comma-separated list that supports wildcard (*) patterns.
_source_excludesstring[]No—A comma-separated list of source fields to exclude from the response. You can also use this parameter to exclude fields from the subset specified in _source_includes query parameter. If the _source parameter is false, this parameter is ignored.
_source_exclude_vectorsbooleanNo—Whether vectors should be excluded from _source
_source_includesstring[]No—A comma-separated list of source fields to include in the response. If this parameter is specified, only these source fields are returned. You can exclude fields from this subset using the _source_excludes query parameter. If the _source parameter is false, this parameter is ignored.
seq_no_primary_termbooleanNo—If true, the request returns the sequence number and primary term of the last modification of each hit.
qstringNo—A query in the Lucene query string syntax. Query parameter searches do not support the full Elasticsearch Query DSL but are handy for testing. IMPORTANT: This parameter overrides the query parameter in the request body. If both parameters are specified, documents matching the query request body parameter are not returned.
sizenumberNo—The number of hits to return. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.
fromnumberNo—The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.
sortstring[]No—A comma-separated list of &lt;field&gt;:&lt;direction&gt; pairs.
aggregationsobjectNo—Defines the aggregations that are run as part of the search request.
collapseobjectNo—Collapses search results the values of the specified field.
extobjectNo—Configuration of search extensions defined by Elasticsearch plugins.
fieldsobject[]No—An array of wildcard (*) field patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.
highlightobjectNo—Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
indices_boostobject[]No—Boost the _score of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than 1.0 increases the score. A boost value between 0 and 1.0 decreases the score.
knnobject[]No—The approximate kNN search to run.
min_scorenumberNo—The minimum _score for matching documents. Documents with a lower _score are not included in search results and results collected by aggregations.
pitobjectNo—Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an &lt;index&gt; in the request path.
post_filterobjectNo—Use the post_filter parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results.
profilebooleanNo—Set to true to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.
queryobjectNo—The search definition using the Query DSL.
rankobjectNo—The Reciprocal Rank Fusion (RRF) to use.
rescoreobjectNo—Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the query and post_filter phases.
retrieverobjectNo—A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as query and knn.
runtime_mappingsobjectNo—One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.
script_fieldsobjectNo—Retrieve a script evaluation (based on different fields) for each hit.
search_afterobjectNo—Used to retrieve the next page of hits using a set of sort values from the previous page.
sliceobjectNo—Split a scrolled search into multiple slices that can be consumed independently.
suggestobjectNo—Defines a suggester that provides similar looking terms based on a provided text.

​
elasticsearch_search_shards

Get the search shards Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams and indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
expand_wildcardsstring[]No—Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
localbooleanNo—If true, the request retrieves information from the local node only.
master_timeoutstringNo—The period to wait for a connection to the master node. If the master node is not available before the timeout expires, the request fails and returns an error. IT can also be set to -1 to indicate that the request should never timeout.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
routingstring[]No—A custom value used to route operations to a specific shard.

​
elasticsearch_search_template

Run a search with a search template Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*).
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
ccs_minimize_roundtripsbooleanNo—Indicates whether network round-trips should be minimized as part of cross-cluster search requests execution.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
explainbooleanNo—If true, the response includes additional details about score computation as part of a hit.
ignore_throttledbooleanNo—If true, specified concrete, expanded, or aliased indices are not included in the response when throttled.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
profilebooleanNo—If true, the query execution is profiled.
routingstring[]No—A custom value used to route operations to a specific shard.
scrollstringNo—Specifies how long a consistent view of the index should be maintained for scrolled search.
search_typestringNo—The type of the search operation. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
rest_total_hits_as_intbooleanNo—If true, hits.total is rendered as an integer in the response. If false, it is rendered as an object.
typed_keysbooleanNo—If true, the response prefixes aggregation and suggester names with their respective types.
idobjectNo—The ID of the search template to use. If no source is specified, this parameter is required.
paramsobjectNo—Key-value pairs used to replace Mustache variables in the template. The key is the variable name. The value is the variable value.
sourceobjectNo—An inline search template. Supports the same parameters as the search API’s request body. It also supports Mustache variables. If no id is specified, this parameter is required.

​
elasticsearch_search_terms_enum

Get terms in an index Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and index aliases to search. Wildcard (*) expressions are supported. To search all data streams or indices, omit this parameter or use * or _all.
case_insensitivebooleanNo—When true, the provided search string is matched against index terms without case sensitivity.
fieldobjectYes—The string to match at the start of indexed terms. If not provided, all terms in the field are considered.
index_filterobjectNo—Filter an index shard if the provided query rewrites to match_none.
search_afterstringNo—The string after which terms in the index should be returned. It allows for a form of pagination if the last result from one request is passed as the search_after parameter for a subsequent request.
sizenumberNo—The number of matching terms to return.
stringstringNo—The string to match at the start of indexed terms. If it is not provided, all terms in the field are considered. > info > The prefix string cannot be larger than the largest possible keyword value, which is Lucene’s term byte-length limit of 32766.
timeoutobjectNo—The maximum length of time to spend collecting results. If the timeout is exceeded the complete flag set to false in the response and the results may be partial or empty.

​
elasticsearch_search_termvectors

Get term vector information Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the index that contains the document.
idstringYes—A unique identifier for the document.
fieldsstring[]No—A comma-separated list or wildcard expressions of fields to include in the statistics. It is used as the default list unless a specific field list is provided in the completion_fields or fielddata_fields parameters.
field_statisticsbooleanNo—If true, the response includes: * The document count (how many documents contain this field). * The sum of document frequencies (the sum of document frequencies for all terms in this field). * The sum of total term frequencies (the sum of total term frequencies of each term in this field).
offsetsbooleanNo—If true, the response includes term offsets.
payloadsbooleanNo—If true, the response includes term payloads.
positionsbooleanNo—If true, the response includes term positions.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
realtimebooleanNo—If true, the request is real-time as opposed to near-real-time.
routingstring[]No—A custom value that is used to route operations to a specific shard.
term_statisticsbooleanNo—If true, the response includes: * The total term frequency (how often a term occurs in all documents). * The document frequency (the number of documents containing the current term). By default these values are not returned since term statistics can have a serious performance impact.
versionnumberNo—If true, returns the document version as part of a hit.
version_typestringNo—The version type. Supported values include: - internal: Use internal versioning that starts at 1 and increments with each update or delete. - external: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document. - external_gte: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document. NOTE: The external_gte version type is meant for special use cases and should be used with care. If used incorrectly, it can result in loss of data.
docobjectNo—An artificial document (a document not present in the index) for which you want to retrieve term vectors.
filterobjectNo—Filter terms based on their tf-idf scores. This could be useful in order find out a good characteristic vector of a document. This feature works in a similar manner to the second phase of the More Like This Query.
per_field_analyzerobjectNo—Override the default per-field analyzer. This is useful in order to generate term vectors in any fashion, especially when using artificial documents. When providing an analyzer for a field that already stores term vectors, the term vectors will be regenerated.

​
elasticsearch_search_update

Update a document Parameters:
ParameterTypeRequiredDefaultDescription
indexstringYes—The name of the target index. By default, the index is created automatically if it doesn’t exist.
idstringYes—A unique identifier for the document to be updated.
if_primary_termnumberNo—Only perform the operation if the document has this primary term.
if_seq_nonumberNo—Only perform the operation if the document has this sequence number.
include_source_on_errorbooleanNo—True or false if to include the document source in the error message in case of parsing errors.
langstringNo—The script language.
refreshstringNo—If ‘true’, Elasticsearch refreshes the affected shards to make this operation visible to search. If ‘wait_for’, it waits for a refresh to make this operation visible to search. If ‘false’, it does nothing with refreshes.
require_aliasbooleanNo—If true, the destination must be an index alias.
retry_on_conflictnumberNo—The number of times the operation should be retried when a conflict occurs.
routingstring[]No—A custom value used to route operations to a specific shard.
timeoutstringNo—The period to wait for the following operations: dynamic mapping updates and waiting for active shards. Elasticsearch waits for at least the timeout period before failing. The actual wait time could be longer, particularly when multiple waits occur.
wait_for_active_shardsobjectNo—The number of copies of each shard that must be active before proceeding with the operation. Set to ‘all’ or any positive integer up to the total number of shards in the index (number_of_replicas+1). The default value of 1 means it waits for each primary shard to be active.
_sourceobjectNo—If false, source retrieval is turned off. You can also specify a comma-separated list of the fields you want to retrieve.
_source_excludesstring[]No—The source fields you want to exclude.
_source_includesstring[]No—The source fields you want to retrieve.
detect_noopbooleanNo—If true, the result in the response is set to noop (no operation) when there are no changes to the document.
docobjectNo—A partial update to an existing document. If both doc and script are specified, doc is ignored.
doc_as_upsertbooleanNo—If true, use the contents of ‘doc’ as the value of ‘upsert’. NOTE: Using ingest pipelines with doc_as_upsert is not supported.
scriptobjectNo—The script to run to update the document.
scripted_upsertbooleanNo—If true, run the script whether or not the document exists.
upsertobjectNo—If the document does not already exist, the contents of ‘upsert’ are inserted as a new document. If the document exists, the ‘script’ is run.

​
elasticsearch_search_update_by_query

Update documents Parameters:
ParameterTypeRequiredDefaultDescription
indexstring[]Yes—A comma-separated list of data streams, indices, and aliases to search. It supports wildcards (*). To search all data streams or indices, omit this parameter or use * or _all.
allow_no_indicesbooleanNo—A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.
analyzerstringNo—The analyzer to use for the query string. This parameter can be used only when the q query string parameter is specified.
analyze_wildcardbooleanNo—If true, wildcard and prefix queries are analyzed. This parameter can be used only when the q query string parameter is specified.
conflictsstringNo—The preferred behavior when update by query hits version conflicts: abort or proceed. Supported values include: - abort: Stop reindexing if there are conflicts. - proceed: Continue reindexing even if there are conflicts.
default_operatorstringNo—The default operator for query string query: and or or. This parameter can be used only when the q query string parameter is specified.
dfstringNo—The field to use as default where no field prefix is given in the query string. This parameter can be used only when the q query string parameter is specified.
expand_wildcardsstring[]No—The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden. Supported values include: - all: Match any data stream or index, including hidden ones. - open: Match open, non-hidden indices. Also matches any non-hidden data stream. - closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed. - hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both. - none: Wildcard expressions are not accepted.
fromnumberNo—Skips the specified number of documents.
ignore_unavailablebooleanNo—If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.
lenientbooleanNo—If true, format-based query failures (such as providing text to a numeric field) in the query string will be ignored. This parameter can be used only when the q query string parameter is specified.
max_docsnumberNo—The maximum number of documents to process. It defaults to all documents. When set to a value less than or equal to scroll_size and conflicts is set to abort, a scroll will not be used to retrieve the results for the operation.
pipelinestringNo—The ID of the pipeline to use to preprocess incoming documents. If the index has a default ingest pipeline specified, then setting the value to _none disables the default ingest pipeline for this request. If a final pipeline is configured it will always run, regardless of the value of this parameter.
preferencestringNo—The node or shard the operation should be performed on. It is random by default.
qstringNo—A query in the Lucene query string syntax.
refreshbooleanNo—If true, Elasticsearch refreshes affected shards to make the operation visible to search after the request completes. This is different than the update API’s refresh parameter, which causes just the shard that received the request to be refreshed.
request_cachebooleanNo—If true, the request cache is used for this request. It defaults to the index-level setting.
requests_per_secondnumberNo—The throttle for this request in sub-requests per second.
routingstring[]No—A custom value used to route operations to a specific shard.
scrollstringNo—The period to retain the search context for scrolling.
scroll_sizenumberNo—The size of the scroll request that powers the operation.
search_timeoutstringNo—An explicit timeout for each search request. By default, there is no timeout.
search_typestringNo—The type of the search operation. Available options include query_then_fetch and dfs_query_then_fetch. Supported values include: - query_then_fetch: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate. - dfs_query_then_fetch: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
slicesobjectNo—The number of slices this task should be divided into.
sortstring[]No—A comma-separated list of <field>:<direction> pairs.
statsstring[]No—The specific tag of the request for logging and statistical purposes.
terminate_afternumberNo—The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this parameter to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this parameter for requests that target data streams with backing indices across multiple data tiers.
timeoutstringNo—The period each update request waits for the following operations: dynamic mapping updates, waiting for active shards. By default, it is one minute. This guarantees Elasticsearch waits for at least the timeout before failing. The actual wait time could be longer, particularly when multiple waits occur.
versionbooleanNo—If true, returns the document version as part of a hit.
version_typebooleanNo—Should the document increment the version number (internal) on hit or not (reindex)
wait_for_active_shardsobjectNo—The number of shard copies that must be active before proceeding with the operation. Set to all or any positive integer up to the total number of shards in the index (number_of_replicas+1). The timeout parameter controls how long each write request waits for unavailable shards to become available. Both work exactly the way they work in the bulk API.
wait_for_completionbooleanNo—If true, the request blocks until the operation is complete. If false, Elasticsearch performs some preflight checks, launches the request, and returns a task ID that you can use to cancel or get the status of the task. Elasticsearch creates a record of this task as a document at .tasks/task/$&#123;taskId&#125;.
queryobjectNo—The documents to update using the Query DSL.
scriptobjectNo—The script to run to update the document source or metadata when updating.
sliceobjectNo—Slice the request manually using the provided slice ID and total number of slices.

​
elasticsearch_search_update_by_query_rethrottle

Throttle an update by query operation Parameters:
ParameterTypeRequiredDefaultDescription
task_idstringYes—The ID for the task.
requests_per_secondnumberYes—The throttle for this request in sub-requests per second. To turn off throttling, set it to -1.