Executes several fleet searches with a single API request
Technical preview; Added in 7.16.0
All methods and paths for this operation:
The API follows the same structure as the multi search (_msearch
) API.
However, similar to the fleet search API, it supports the wait_for_checkpoints
parameter.
Required authorization
- Index privileges:
read
Path parameters
-
A single target to search. If the target is an index alias, it must resolve to a single index.
Query parameters
-
If false, the request returns an error if any wildcard expression, index alias, or _all value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting foo*,bar* returns an error if an index starts with foo but no index starts with bar.
-
If true, network roundtrips between the coordinating node and remote clusters are minimized for cross-cluster search requests.
-
Type of index that wildcard expressions can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams.
Supported values include:
all
: Match any data stream or index, including hidden ones.open
: Match open, non-hidden indices. Also matches any non-hidden data stream.closed
: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.hidden
: Match hidden data streams and hidden indices. Must be combined withopen
,closed
, orboth
.none
: Wildcard expressions are not accepted.
Values are
all
,open
,closed
,hidden
, ornone
. -
If true, concrete, expanded or aliased indices are ignored when frozen.
-
If true, missing or closed indices are not included in the response.
-
Maximum number of concurrent searches the multi search API can execute.
-
Maximum number of concurrent shard requests that each sub-search request executes per node.
-
Defines a threshold that enforces a pre-filter roundtrip to prefilter search shards based on query rewriting if the number of shards the search request expands to exceeds the threshold. This filter roundtrip can limit the number of shards significantly if for instance a shard can not match any documents based on its rewrite method i.e., if date filters are mandatory to match but the shard bounds and the query are disjoint.
-
Indicates whether global term and document frequencies should be used when scoring returned documents.
Supported values include:
query_then_fetch
: Documents are scored using local term and document frequencies for the shard. This is usually faster but less accurate.dfs_query_then_fetch
: Documents are scored using global term and document frequencies across all shards. This is usually slower but more accurate.
Values are
query_then_fetch
ordfs_query_then_fetch
. -
If true, hits.total are returned as an integer in the response. Defaults to false, which returns an object.
-
Specifies whether aggregation and suggester names should be prefixed by their respective types in the response.
-
A comma separated list of checkpoints. When configured, the search API will only be executed on a shard after the relevant checkpoint has become visible for search. Defaults to an empty list which will cause Elasticsearch to immediately execute the search.
-
If true, returns partial results if there are shard request timeouts or shard failures. If false, returns an error with no partial results. Defaults to the configured cluster setting
search.default_allow_partial_results
which is true by default.
Body
object
Required
Contains parameters used to limit or change the subsequent search body request.
-
Values are
query_then_fetch
ordfs_query_then_fetch
.
-
External documentation -
External documentation -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation -
If true, returns detailed information about score computation as part of a hit.
Default value is
false
. -
Configuration of search extensions defined by Elasticsearch plugins.
-
Array of wildcard (*) patterns. The request returns doc values for field names matching these patterns in the hits.fields property of the response.
A reference to a field with formatting instructions on how to return the value
knn
object | array[object] Defines the approximate kNN search to run.
One of: Hide attributes Show attributes
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The final number of nearest neighbors to return as top hits
-
The number of nearest neighbor candidates to consider per shard
-
Boost value to apply to kNN scores
filter
object | array[object] Filters for the kNN search query
One of: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
The minimum similarity for a vector to be considered a match
-
Hide inner_hits attributes Show inner_hits attributes object
-
The maximum number of hits to return per
inner_hits
.Default value is
3
. -
Inner hit starting document offset.
Default value is
0
. -
External documentation -
A reference to a field with formatting instructions on how to return the value
A reference to a field with formatting instructions on how to return the value
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Default value is
false
.
Hide attributes Show attributes object
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The final number of nearest neighbors to return as top hits
-
The number of nearest neighbor candidates to consider per shard
-
Boost value to apply to kNN scores
-
The minimum similarity for a vector to be considered a match
-
Hide inner_hits attributes Show inner_hits attributes object
-
The maximum number of hits to return per
inner_hits
.Default value is
3
. -
Inner hit starting document offset.
Default value is
0
. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Default value is
false
.
-
-
Starting document offset. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.
Default value is
0
. -
Hide highlight attributes Show highlight attributes object
-
A string that contains each boundary character.
Default value is
.,!? \t\n
. -
How far to scan for boundary characters.
Default value is
20
. -
Values are
chars
,sentence
, orword
. -
Controls which locale is used to search for sentence and word boundaries. This parameter takes a form of a language tag, for example:
"en-US"
,"fr-FR"
,"ja-JP"
.Default value is
Locale.ROOT
. -
Values are
simple
orspan
. -
The size of the highlighted fragment in characters.
Default value is
100
. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation -
If set to a non-negative value, highlighting stops at this defined maximum limit. The rest of the text is not processed, thus not highlighted and no error is returned The
max_analyzed_offset
query setting does not override theindex.highlight.max_analyzed_offset
setting, which prevails when it’s set to lower value than the query setting. -
The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight.
Default value is
0
. -
The maximum number of fragments to return. If the number of fragments is set to
0
, no fragments are returned. Instead, the entire field contents are highlighted and returned. This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required. Ifnumber_of_fragments
is0
,fragment_size
is ignored.Default value is
5
. -
Value is
score
. -
Controls the number of matching phrases in a document that are considered. Prevents the
fvh
highlighter from analyzing too many phrases and consuming too much memory. When usingmatched_fields
,phrase_limit
phrases per matched field are considered. Raising the limit increases query time and consumes more memory. Only supported by thefvh
highlighter.Default value is
256
. -
Use in conjunction with
pre_tags
to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in<em>
and</em>
tags. -
Use in conjunction with
post_tags
to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in<em>
and</em>
tags. -
By default, only fields that contains a query match are highlighted. Set to
false
to highlight all fields.Default value is
true
. -
Value is
styled
. -
Values are
default
orhtml
.
-
Boosts the _score of documents from specified indices.
-
Minimum _score for matching documents. Documents with a lower _score are not included in the search results.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation rescore
object | array[object] One of: Hide attributes Show attributes
-
Hide query attributes Show query attributes object
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Relative importance of the original query versus the rescore query.
Default value is
1
. -
Relative importance of the rescore query versus the original query.
Default value is
1
. -
Values are
avg
,max
,min
,multiply
, ortotal
.
-
-
Retrieve a script evaluation (based on different fields) for each hit.
Hide script_fields attribute Show script_fields attribute object
-
Hide * attributes Show * attributes object
-
-
A field value.
A field value.
-
The number of hits to return. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.
Default value is
10
. sort
string | object | array[string | object] One of: Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Hide attributes Show attributes
-
Hide _geo_distance attributes Show _geo_distance attributes object
-
Array of wildcard (*) patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.
A reference to a field with formatting instructions on how to return the value
-
Maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. Defaults to 0, which does not terminate query execution early.
Default value is
0
. -
Stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.
-
Specifies the period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
-
If true, calculate and return document scores, even if the scores are not used for sorting.
Default value is
false
. -
Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.
-
If true, returns document version as part of a hit.
Default value is
false
. -
Hide runtime_mappings attribute Show runtime_mappings attribute object
-
Hide * attributes Show * attributes object
-
For type
composite
-
For type
lookup
-
A custom format for
date
type runtime fields. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Hide script attributes Show script attributes object
-
Values are
boolean
,composite
,date
,double
,geo_point
,geo_shape
,ip
,keyword
,long
, orlookup
.
-
-
-
If true, returns sequence number and primary term of the last modification of each hit. See Optimistic concurrency control.
Responses
-
Hide response attribute Show response attribute object
-
One of: Hide attributes Show attributes
-
The number of milliseconds it took Elasticsearch to run the request. This value is calculated by measuring the time elapsed between receipt of a request on the coordinating node and the time at which the coordinating node is ready to send the response. It includes:
- Communication time between the coordinating node and data nodes
- Time the request spends in the search thread pool, queued for execution
- Actual run time
It does not include:
- Time needed to send the request to Elasticsearch
- Time needed to serialize the JSON response
- Time needed to send the response to a client
-
If
true
, the request timed out before completion; returned results may be partial or empty.
The response returned by Elasticsearch when request execution did not succeed.
Hide attributes Show attributes
-
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Hide error attributes Show error attributes object
-
The type of error
-
The server stack trace. Present only if the
error_trace=true
parameter was sent with the request. -
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
-
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
-
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
-
-
-
curl \
--request POST 'http://api.example.com/{index}/_fleet/_fleet_msearch' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '[{"allow_no_indices":true,"expand_wildcards":"string","ignore_unavailable":true,"index":"string","preference":"string","request_cache":true,"routing":"string","search_type":"query_then_fetch","ccs_minimize_roundtrips":true,"allow_partial_search_results":true,"ignore_throttled":true}]'