Elastic Stack (ELK Stack) Esql API

openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Esql API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:
- name: esql
paths:
  /_query/async:
    post:
      tags:
      - esql
      summary: Run an async ES|QL query
      description: 'Asynchronously run an ES|QL (Elasticsearch query language) query, monitor its progress, and retrieve results when they become available.


        The API accepts the same parameters and request body as the synchronous query API, along with additional async related properties.


        ## Required authorization


        * Index privileges: `read`

        '
      externalDocs:
        description: More about ES|QL reference
        url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/esql
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/esql-async-query-api.html
      operationId: esql-async-query
      parameters:
      - in: query
        name: allow_partial_results
        description: 'If `true`, partial results will be returned if there are shard failures, but the query can continue to execute on other clusters and shards.

          If `false`, the query will fail if there are any failures.


          To override the default behavior, you can set the `esql.query.allow_partial_results` cluster setting to `false`.'
        deprecated: false
        schema:
          default: true
          type: boolean
        style: form
      - in: query
        name: delimiter
        description: 'The character to use between values within a CSV row.

          It is valid only for the CSV format.'
        deprecated: false
        schema:
          default: ','
          type: string
        style: form
      - in: query
        name: drop_null_columns
        description: 'Indicates whether columns that are entirely `null` will be removed from the `columns` and `values` portion of the results.

          If `true`, the response will include an extra section under the name `all_columns` which has the name of all the columns.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      - in: query
        name: format
        description: 'A short version of the Accept header, e.g. json, yaml.


          `csv`, `tsv`, and `txt` formats will return results in a tabular format, excluding other metadata fields from the response.


          For async requests, nothing will be returned if the async query doesn''t finish within the timeout.

          The query ID and running status are available in the `X-Elasticsearch-Async-Id` and `X-Elasticsearch-Async-Is-Running` HTTP headers of the response, respectively.'
        deprecated: false
        schema:
          $ref: '#/components/schemas/esql._types.EsqlFormat'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                columnar:
                  description: By default, ES|QL returns results as rows. For example, FROM returns each individual document as one row. For the JSON, YAML, CBOR and smile formats, ES|QL can return the results in a columnar fashion where one row represents all the values of a certain column in the results.
                  type: boolean
                filter:
                  description: Specify a Query DSL query in the filter parameter to filter the set of documents that an ES|QL query runs on.
                  allOf:
                  - $ref: '#/components/schemas/_types.query_dsl.QueryContainer'
                time_zone:
                  description: Sets the default timezone of the query.
                  x-state: Generally available; Added in 9.4.0
                  type: string
                locale:
                  description: Returns results (especially dates) formatted per the conventions of the locale.
                  type: string
                params:
                  description: To avoid any attempts of hacking or code injection, extract the values in a separate list of parameters. Use question mark placeholders (?) in the query string for each of the parameters.
                  allOf:
                  - $ref: '#/components/schemas/esql._types.ESQLParams'
                profile:
                  description: 'If provided and `true` the response will include an extra `profile` object

                    with information on how the query was executed. This information is for human debugging

                    and its format can change at any time but it can give some insight into the performance

                    of each part of the query.'
                  type: boolean
                query:
                  description: The ES|QL query API accepts an ES|QL query string in the query parameter, runs it, and returns the results.
                  type: string
                tables:
                  description: 'Tables to use with the LOOKUP operation. The top level key is the table

                    name and the next level key is the column name.'
                  type: object
                  additionalProperties:
                    type: object
                    additionalProperties:
                      $ref: '#/components/schemas/esql._types.TableValuesContainer'
                include_ccs_metadata:
                  description: 'When set to `true` and performing a cross-cluster/cross-project query, the response will include an extra `_clusters`

                    object with information about the clusters that participated in the search along with info such as shards

                    count.'
                  default: false
                  type: boolean
                include_execution_metadata:
                  description: 'When set to `true`, the response will include an extra `_clusters`

                    object with information about the clusters that participated in the search along with info such as shards

                    count.

                    This is similar to `include_ccs_metadata`, but it also returns metadata when the query is not CCS/CPS'
                  default: false
                  type: boolean
                wait_for_completion_timeout:
                  description: 'The period to wait for the request to finish.

                    By default, the request waits for 1 second for the query results.

                    If the query completes during this period, results are returned

                    Otherwise, a query ID is returned that can later be used to retrieve the results.'
                  default: 1s
                  allOf:
                  - $ref: '#/components/schemas/_types.Duration'
                keep_alive:
                  description: 'The period for which the query and its results are stored in the cluster.

                    The default period is five days.

                    When this period expires, the query and its results are deleted, even if the query is still ongoing.

                    If the `keep_on_completion` parameter is false, Elasticsearch only stores async queries that do not complete within the period set by the `wait_for_completion_timeout` parameter, regardless of this value.'
                  default: 5d
                  allOf:
                  - $ref: '#/components/schemas/_types.Duration'
                keep_on_completion:
                  description: 'Indicates whether the query and its results are stored in the cluster.

                    If false, the query and its results are stored in the cluster only if the request does not complete during the period set by the `wait_for_completion_timeout` parameter.'
                  default: false
                  type: boolean
                settings:
                  description: 'Per-query settings, the request-body equivalent of the in-query `SET` command.

                    For example, `time_zone` can be supplied here instead of as a top-level field.'
                  x-state: Generally available; Added in 9.5.0
                  allOf:
                  - $ref: '#/components/schemas/esql._types.EsqlQuerySettings'
              required:
              - query
            examples:
              AsyncQueryRequestExample1:
                value: "{\n  \"query\": \"\"\"\n    FROM library,remote-*:library\n    | EVAL year = DATE_TRUNC(1 YEARS, release_date)\n    | STATS MAX(page_count) BY year\n    | SORT year\n    | LIMIT 5\n  \"\"\",\n  \"wait_for_completion_timeout\": \"2s\",\n  \"include_ccs_metadata\": true\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/esql._types.AsyncEsqlResult'
      x-state: Generally available; Added in 8.13.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/async/{id}:
    get:
      tags:
      - esql
      summary: Get async ES|QL query results
      description: 'Get the current status and available results or stored results for an ES|QL asynchronous query.

        If the Elasticsearch security features are enabled, only the user who first submitted the ES|QL query can retrieve the results using this API.


        ## Required authorization


        * Index privileges: `read`

        '
      externalDocs:
        description: More about ES|QL reference
        url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/esql
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/esql-async-query-get-api.html
      operationId: esql-async-query-get
      parameters:
      - in: path
        name: id
        description: 'The unique identifier of the query.

          A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time.

          A query ID is also provided when the request was submitted with the `keep_on_completion` parameter set to `true`.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      - in: query
        name: drop_null_columns
        description: 'Indicates whether columns that are entirely `null` will be removed from the `columns` and `values` portion of the results.

          If `true`, the response will include an extra section under the name `all_columns` which has the name of all the columns.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      - in: query
        name: format
        description: A short version of the Accept header, for example `json` or `yaml`.
        deprecated: false
        schema:
          $ref: '#/components/schemas/esql._types.EsqlFormat'
        style: form
      - in: query
        name: keep_alive
        description: 'The period for which the query and its results are stored in the cluster.

          When this period expires, the query and its results are deleted, even if the query is still ongoing.'
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: wait_for_completion_timeout
        description: 'The period to wait for the request to finish.

          By default, the request waits for complete query results.

          If the request completes during the period specified in this parameter, complete query results are returned.

          Otherwise, the response returns an `is_running` value of `true` and no results.'
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/esql._types.AsyncEsqlResult'
      x-state: Generally available; Added in 8.13.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - esql
      summary: Delete an async ES|QL query
      description: 'If the query is still running, it is cancelled.

        Otherwise, the stored results are deleted.


        If the Elasticsearch security features are enabled, only the following users can use this API to delete a query:


        * The authenticated user that submitted the original query request

        * Users with the `cancel_task` cluster privilege'
      externalDocs:
        description: More about ES|QL reference
        url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/esql
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/esql-async-query-delete-api.html
      operationId: esql-async-query-delete
      parameters:
      - in: path
        name: id
        description: 'The unique identifier of the query.

          A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time.

          A query ID is also provided when the request was submitted with the `keep_on_completion` parameter set to `true`.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
      x-state: Generally available; Added in 8.13.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/async/{id}/stop:
    post:
      tags:
      - esql
      summary: Stop async ES|QL query
      description: 'This API interrupts the query execution and returns the results so far.

        If the Elasticsearch security features are enabled, only the user who first submitted the ES|QL query can stop it.


        ## Required authorization


        * Index privileges: `read`

        '
      externalDocs:
        description: More about ES|QL reference
        url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/esql
      operationId: esql-async-query-stop
      parameters:
      - in: path
        name: id
        description: 'The unique identifier of the query.

          A query ID is provided in the ES|QL async query API response for a query that does not complete in the designated time.

          A query ID is also provided when the request was submitted with the `keep_on_completion` parameter set to `true`.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      - in: query
        name: drop_null_columns
        description: 'Indicates whether columns that are entirely `null` will be removed from the `columns` and `values` portion of the results.

          If `true`, the response will include an extra section under the name `all_columns` which has the name of all the columns.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/esql._types.EsqlResult'
      x-state: Generally available; Added in 8.18.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/data_source/{name}:
    get:
      tags:
      - esql
      summary: Get ES|QL data sources
      description: 'Returns one or more data sources used in ES|QL data federation.

        A concrete-name miss returns `404`; a wildcard pattern or list-all request with no match

        returns `200` with an empty array.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-get-data-source-1
      parameters:
      - $ref: '#/components/parameters/esql.get_data_source-name'
      - $ref: '#/components/parameters/esql.get_data_source-master_timeout'
      responses:
        '200':
          $ref: '#/components/responses/esql.get_data_source-200'
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - esql
      summary: Create or update an ES|QL data source
      description: 'Creates or replaces a named, type-specific data source configuration for ES|QL data federation.

        Datasets reference data source configurations to access external data. Names must be lowercase

        and follow index or alias naming rules.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-put-data-source
      parameters:
      - in: path
        name: name
        description: The data source name to create or update.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      - in: query
        name: master_timeout
        description: Period to wait for a connection to the master node.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: The time to wait for the request to be completed.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                type:
                  description: 'The data source type. Currently, `s3` is supported.

                    The value must be lowercase and contain no whitespace.'
                  type: string
                description:
                  description: A free-text description of the data source.
                  type: string
                settings:
                  description: 'Type-specific connection and authentication settings.

                    For `s3`, connection settings include `region` and `endpoint`. Authentication settings

                    include `auth` and the credentials required by the selected authentication method.'
                  type: object
                  additionalProperties:
                    type: object
              required:
              - type
            examples:
              PutDataSourceRequestExample1:
                summary: Create an S3 data source
                description: 'Create a data source for production logs stored in Amazon S3. The data source uses static credentials and connects to a bucket in the us-east-1 region.

                  '
                value: "{\n  \"type\": \"s3\",\n  \"description\": \"Production S3 logs bucket\",\n  \"settings\": {\n    \"region\": \"us-east-1\",\n    \"auth\": \"static_credentials\",\n    \"access_key\": \"<AWS_ACCESS_KEY_ID>\",\n    \"secret_key\": \"<AWS_SECRET_ACCESS_KEY>\"\n  }\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                PutDataSourceResponseExample1:
                  summary: Data source created
                  description: The data source configuration was stored successfully.
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - esql
      summary: Delete ES|QL data sources
      description: 'Deletes one or more data sources used in ES|QL data federation.

        Fails with `409` if any dataset references one of the named data sources;

        delete the dependent datasets first.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-delete-data-source
      parameters:
      - in: path
        name: name
        description: A comma-separated list of data source names to delete.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Names'
        style: simple
      - in: query
        name: master_timeout
        description: Period to wait for a connection to the master node.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: The time to wait for the request to be completed.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                DeleteDataSourceResponseExample1:
                  summary: Data source deleted
                  description: The data source configuration was deleted successfully.
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/dataset/{name}:
    get:
      tags:
      - esql
      summary: Get ES|QL datasets
      description: 'Returns one or more datasets used in ES|QL data federation.

        A concrete-name miss returns `404`; a wildcard pattern or list-all request with no match

        returns `200` with an empty array.


        ## Required authorization


        * Index privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-get-dataset-1
      parameters:
      - $ref: '#/components/parameters/esql.get_dataset-name'
      - $ref: '#/components/parameters/esql.get_dataset-master_timeout'
      responses:
        '200':
          $ref: '#/components/responses/esql.get_dataset-200'
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - esql
      summary: Create or update an ES|QL dataset
      description: 'Creates or replaces a dataset that references a data source in ES|QL data federation.

        Dataset names participate in the index namespace and must follow index or alias naming rules.

        Returns `404` if the referenced data source does not exist.


        ## Required authorization


        * Index privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-put-dataset
      parameters:
      - in: path
        name: name
        description: The dataset name to create or update.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      - in: query
        name: master_timeout
        description: Period to wait for a connection to the master node.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: The time to wait for the request to be completed.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                data_source:
                  description: The name of the referenced data source. The data source must already exist.
                  allOf:
                  - $ref: '#/components/schemas/_types.Name'
                resource:
                  description: 'The URI that identifies the data to read, resolved against the referenced data source.

                    It can include glob patterns. For example, a recursive pattern can match

                    all Parquet files under the `s3://logs-bucket/access` prefix.'
                  type: string
                description:
                  description: A free-text description of the dataset.
                  type: string
                mappings:
                  description: User-declared mapping on the dataset definition
                  allOf:
                  - $ref: '#/components/schemas/esql._types.DatasetMapping'
                settings:
                  description: 'Format and parsing-specific settings that configure how the resource is read.

                    Common keys include `format`, which explicitly selects a registered format, and

                    `partition_detection`, which accepts `auto`, `hive`, `template`, or `none`. Additional

                    keys depend on the format reader. Compression can be inferred from the resource URI.'
                  type: object
                  additionalProperties:
                    type: object
              required:
              - data_source
              - resource
            examples:
              PutDatasetRequestExample1:
                summary: Create a Parquet dataset
                description: 'Create a dataset that reads partitioned Parquet access logs through the prod_s3_logs data source.

                  '
                value: "{\n  \"data_source\": \"prod_s3_logs\",\n  \"resource\": \"s3://logs-bucket/access/**/*.parquet\",\n  \"description\": \"Production access logs\",\n  \"settings\": {\n    \"partition_detection\": \"hive\"\n  }\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                PutDatasetResponseExample1:
                  summary: Dataset created
                  description: The dataset definition was stored successfully.
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - esql
      summary: Delete ES|QL datasets
      description: 'Deletes one or more datasets used in ES|QL data federation.

        If any specified dataset does not exist, the request fails and no datasets are deleted.


        ## Required authorization


        * Index privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-delete-dataset
      parameters:
      - in: path
        name: name
        description: A comma-separated list of dataset names to delete.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Names'
        style: simple
      - in: query
        name: master_timeout
        description: Period to wait for a connection to the master node.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: The time to wait for the request to be completed.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                DeleteDatasetResponseExample1:
                  summary: Dataset deleted
                  description: The dataset definition was deleted successfully.
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/view/{name}:
    get:
      tags:
      - esql
      summary: Get an ES|QL view
      description: 'Returns a stored ES|QL view.


        ## Required authorization


        * Index privileges: `read_view_metadata`

        '
      operationId: esql-get-view-1
      parameters:
      - $ref: '#/components/parameters/esql.get_view-name'
      responses:
        '200':
          $ref: '#/components/responses/esql.get_view-200'
      x-state: Experimental; Added in 9.4.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - esql
      summary: Create or update an ES|QL view
      description: '


        ## Required authorization


        * Index privileges: `create_view`

        '
      operationId: esql-put-view
      parameters:
      - in: path
        name: name
        description: The view name to create or update.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                query:
                  description: The ES|QL query string from which to create a view.
                  type: string
                description:
                  description: A free-text description of the view.
                  type: string
              required:
              - query
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
      x-state: Experimental; Added in 9.4.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - esql
      summary: Delete an ES|QL view
      description: 'Deletes a stored ES|QL view.


        ## Required authorization


        * Index privileges: `delete_view`

        '
      operationId: esql-delete-view
      parameters:
      - in: path
        name: name
        description: The view name to remove.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Ids'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
      x-state: Experimental; Added in 9.4.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_query/data_source:
    get:
      tags:
      - esql
      summary: Get ES|QL data sources
      description: 'Returns one or more data sources used in ES|QL data federation.

        A concrete-name miss returns `404`; a wildcard pattern or list-all request with no match

        returns `200` with an empty array.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      externalDocs:
        description: ES|QL Data Federation
        url: https://www.elastic.co/docs/reference/query-languages/esql/esql-data-federation
      operationId: esql-get-data-source
      parameters:
      - $ref: '#/components/parameters/esql.get_data_source-master_timeout'
      responses:
        '200':
          $ref: '#/com

# --- truncated at 32 KB (384 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-esql-api-openapi.yml