search_dsl
Run raw OpenSearch DSL queries to retrieve full response with hits and aggregations. Time filter is controlled solely by the DSL body, with no hidden default window.
Instructions
Run a raw OpenSearch DSL query. Returns the raw response (hits + aggregations). Aggregations honor the time filter inside the DSL body, so there is no hidden default time window.
Args: index: index or pattern (e.g. "arkime_sessions3-*"). query_dsl: JSON string of a full DSL body ({"query": {...}, "aggs": {...}}). size: max hits (0 for aggregation-only). Always wins over a "size" key inside query_dsl.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | ||
| index | Yes | ||
| query_dsl | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |