Run OpenSearch DSL query
search_dslRead-only
Execute raw OpenSearch DSL queries to retrieve hits and aggregations, giving full control over the query and aggregation bodies while respecting time filters inside the DSL.
Instructions
Run a raw OpenSearch DSL query and return its hits plus aggregations.
Use this for full DSL control over the query and aggregation bodies. When you
only need a match count and not the documents, use count. For Malcolm's
simpler field-filter syntax instead of raw DSL, use malcolm_search.
Aggregations honor the time filter inside the DSL body, so there is no hidden
default time window. Returns the raw OpenSearch _search response.
Both input guards run before any request leaves this server: malformed
query_dsl, and an index containing /, ? or .., are refused as input
errors rather than costing an upstream scan. When the query is easier to
say as an Arkime expression, compile it with arkime_build_query and hand
the index and query_dsl it returns straight to this tool — serialise its
query_dsl object to a JSON string first, which is what this parameter
declares.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Max hits to return; 0 for aggregation-only. Always overrides any "size" key inside query_dsl. | |
| index | Yes | Index or pattern to query, e.g. "arkime_sessions3-*". Accepts a wildcard; must contain no path metachars (/, ?, ..). | |
| query_dsl | Yes | JSON string of a full DSL body, e.g. {"query": {...}, "aggs": {...}}. A bare query object with no "query" key is wrapped as {"query": ...} for you. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |