Look up one session by id
arkime_session_detailRead-only
Fetch Arkime session details by ID via point lookup. Returns the session row for quick access to session metadata without a search.
Instructions
Fetch the session Arkime holds under one id — a point lookup, not a search.
What comes back is Arkime's own session row, which is narrower than the
document behind it: measured on Malcolm v26.07.1 across 17 sessions,
11-14 top-level keys of the 21-30 the stored document held, 400-560
characters against 1-3 KB. `tags`, the `event` block and the Zeek /
Suricata detail were absent every time, and http.md5 was too even where
an http block came back. When the field you need is not in the answer,
read the document itself with malcolm_search, or with search_dsl over
arkime_sessions3-* on a {"term": {"_id": ...}} query taking the part of
the id after the last ":". For the session's raw packets use
arkime_session_pcap; for what the two sides actually sent, the payload
bytes rather than parsed fields, use arkime_session_payload; for
distinct values across many sessions use arkime_unique /
arkime_spiview.
An id this deployment does not hold is answered with a sentence rather
than an error, so a bare "no session found" means the id aged out of
retention or came from somewhere other than arkime_sessions — ids are
not stable across re-indexing.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | One Arkime session id from arkime_sessions results (arkime_sessions is the only source of these ids). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |