{
  "eql.search": {
    "documentation": {
      "url": "https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-eql-search",
      "description": "Get EQL search results"
    },
    "stability": "stable",
    "visibility": "public",
    "headers": {
      "accept": [
        "application/json"
      ],
      "content_type": [
        "application/json"
      ]
    },
    "url": {
      "paths": [
        {
          "path": "/{index}/_eql/search",
          "methods": [
            "GET",
            "POST"
          ],
          "parts": {
            "index": {
              "type": "list",
              "description": "Comma-separated list of index names to scope the operation"
            }
          }
        }
      ]
    },
    "params": {
      "wait_for_completion_timeout": {
        "type": "time",
        "description": "Specify the time that the request should block waiting for the final response"
      },
      "keep_on_completion": {
        "type": "boolean",
        "description": "Control whether the response should be stored in the cluster if it completed within the provided [wait_for_completion] time (default: false)",
        "default": false
      },
      "keep_alive": {
        "type": "time",
        "description": "Update the time interval in which the results (partial or final) for this search will be available",
        "default": "5d"
      },
      "allow_partial_search_results": {
        "type": "boolean",
        "description": "Control whether the query should keep running in case of shard failures, and return partial results",
        "default": true
      },
      "allow_partial_sequence_results": {
        "type": "boolean",
        "description": "Control whether a sequence query should return partial results or no results at all in case of shard failures. This option has effect only if [allow_partial_search_results] is true.",
        "default": false
      },
      "ccs_minimize_roundtrips": {
        "type": "boolean",
        "description": "Indicates whether network round-trips should be minimized as part of cross-cluster search requests execution",
        "default": true
      },
      "ignore_unavailable": {
        "type": "boolean",
        "default": true,
        "description": "Whether specified concrete indices should be ignored when unavailable (missing or closed)"
      },
      "allow_no_indices": {
        "type": "boolean",
        "default": true,
        "description": "Whether to allow (1) wildcard index expressions that match no indices and (2) requests where the final resolved set is empty."
      },
      "expand_wildcards": {
        "type": "list",
        "options": [
          "open",
          "closed",
          "hidden",
          "none",
          "all"
        ],
        "default": "open",
        "description": "Whether to expand wildcard expression to concrete indices that are open, closed or both."
      }
    },
    "body": {
      "description": "Eql request body. Use the `query` to limit the query scope.",
      "required": true
    }
  }
}
