Compile an Arkime expression to OpenSearch DSL
arkime_build_queryRead-only
Translate an Arkime expression into OpenSearch DSL without executing it, enabling inspection and editing of the compiled query before running a search.
Instructions
Translate an Arkime expression into the OpenSearch DSL it compiles to, without running it.
Do NOT use this to run a search: nothing is executed and no session
comes back. Come here only when the DSL itself is the goal — a
substring, wildcard, fuzzy or script clause Arkime's syntax cannot say,
or a look at the compiled query before spending a scan on it. Compile
the part the expression can express, edit the returned DSL, then run it
with search_dsl (or count, which takes the inner query clause only).
When the expression already says what you mean, send it straight to
arkime_sessions for the rows or arkime_sessions_summary for the totals.
Returns JSON shaped for that handoff: `index` and `query_dsl`, the two
arguments search_dsl takes, plus the compiled body's own size and sort,
which search_dsl overrides with its `size`. `query_dsl` is returned as
an object so it can be edited, but search_dsl and count declare it a
JSON STRING: serialise it before the handoff (the object verbatim is
refused with "Input should be a valid string"). `index` is the concrete
daily index the window resolves to, so a window covering no captured day
shows up here rather than as a mysteriously empty search. An expression
Arkime cannot parse is reported as an error naming the offending token:
upstream answers 200 with an error field and no query, which would
otherwise read as success.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). It becomes a range clause on lastPacket in the compiled query and decides which daily indices the search covers. | |
| expression | No | Arkime expression syntax to compile, e.g. "protocols == http && ip.dst == 203.0.113.5". Empty compiles the time window alone, which is a useful starting skeleton. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |