From 70c6031a82c770dd73372b313d3c87c66f5f928f Mon Sep 17 00:00:00 2001 From: Luigi Dell'Aquila Date: Wed, 29 Jan 2025 18:23:48 +0100 Subject: [PATCH] Add default values for EQL allow_partial_search_results and allow_partial_sequence_results (#3637) (cherry picked from commit d74eccacfd5b2f11e9bc4a60cf6ffdf609f1ff41) --- specification/eql/search/EqlSearchRequest.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/specification/eql/search/EqlSearchRequest.ts b/specification/eql/search/EqlSearchRequest.ts index e35f51418b..3240d27584 100644 --- a/specification/eql/search/EqlSearchRequest.ts +++ b/specification/eql/search/EqlSearchRequest.ts @@ -118,7 +118,19 @@ export interface Request extends RequestBase { keep_alive?: Duration keep_on_completion?: boolean wait_for_completion_timeout?: Duration + /** + * Allow query execution also in case of shard failures. + * If true, the query will keep running and will return results based on the available shards. + * For sequences, the behavior can be further refined using allow_partial_sequence_results + * @server_default true + */ allow_partial_search_results?: boolean + /** + * This flag applies only to sequences and has effect only if allow_partial_search_results=true. + * If true, the sequence query will return results based on the available shards, ignoring the others. + * If false, the sequence query will return successfully, but will always have empty results. + * @server_default false + */ allow_partial_sequence_results?: boolean /** * For basic queries, the maximum number of matching events to return. Defaults to 10