Search
es_searchExecute Elasticsearch Query DSL searches against Kibana indices to retrieve and analyze log documents. Specify query, aggregations, sort, and selected fields to control the response.
Instructions
Run an Elasticsearch Query DSL search. Pass the query body as an object. Keep "size" small and pass "source" (aliased as "_source") to select fields — log documents are large and oversized responses get truncated.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| aggs | No | Aggregations clause | |
| from | No | Offset for pagination | |
| size | No | Number of hits to return | |
| sort | No | Sort clause, e.g. [{"@timestamp": "desc"}] | |
| index | Yes | Index or pattern to search | |
| query | No | Query DSL "query" clause, e.g. {"match": {"message": "timeout"}} | |
| source | No | Fields to return, sent as Elasticsearch "_source". Strongly recommended. | |
| _source | No | Alias for "source", accepted because Elasticsearch itself spells it this way. | |
| track_total_hits | No | Set true for an exact total hit count instead of a 10000 cap |