sql_query
Execute Elasticsearch SQL SELECT queries to aggregate and filter data without hand-writing Query DSL. Returns columns and rows, with a cursor for retrieving larger results.
Instructions
Run an Elasticsearch SQL query via the _sql API. Good for quick aggregate/filter questions without hand-writing Query DSL, e.g. SELECT status, COUNT() FROM "logs-" WHERE code >= 500 GROUP BY status. Only SELECT is allowed. The index in FROM is checked against the allow/deny policy. Row count is capped by fetch_size (server result-size limit applies). Returns columns and rows; if there are more rows a cursor is returned to pass back as the cursor argument.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| cursor | No | ||
| fetch_size | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |