Elastic Stack

Elastic Stack (ELK Stack) Esql API

The esql API from Elastic Stack (ELK Stack) — 12 operation(s) for esql.

GitHub OpenAPI

Operations 19

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /_query/async Run an ES|QL query asynchronously · Run an async ES|QL query #
Ask an LLM
“How do I run a long ES|QL query in the background and fetch results later?”
“Can I keep async ES|QL results around after the query completes?”
Tell an agent
Run ES|QL query {query} asynchronously.
Start async ES|QL query {query} and wait up to {wait_for_completion_timeout} for it to finish.
GET /_query/async/{id} Get results of an async ES|QL query · Get async ES|QL query results #
Ask an LLM
“Has my async ES|QL query finished yet?”
“Can I get async ES|QL results back as CSV?”
Tell an agent
Get results for async ES|QL query {id}.
Fetch async ES|QL query {id} results in {format} format.
DELETE /_query/async/{id} Cancel or delete an async ES|QL query · Delete an async ES|QL query #
Ask an LLM
“How do I cancel an async ES|QL query that's still running?”
“Can I delete stored results of a finished async ES|QL query?”
Tell an agent destructive · confirm first
Delete async ES|QL query {id}.
Cancel async ES|QL query {id} and discard its stored results.
POST /_query/async/{id}/stop Stop an async ES|QL query and keep partial results · Stop async ES|QL query #
Ask an LLM
“Can I stop an async ES|QL query and get whatever results it has so far?”
“How do I interrupt a slow ES|QL query without losing partial output?”
Tell an agent
Stop async ES|QL query {id} and return the results so far.
Interrupt ES|QL query {id}, dropping null columns when drop_null_columns is {drop_null_columns}.
GET /_query/data_source/{name} Get ES|QL data sources by name · Get ES|QL data sources #
Ask an LLM
“How do I look up a specific ES|QL federation data source by name?”
“Can I fetch data sources matching a wildcard name pattern?”
Tell an agent
Get ES|QL data source {name}.
Show the data sources matching {name}.
PUT /_query/data_source/{name} Create or update an ES|QL data source · Create or update an ES|QL data source #
Ask an LLM
“How do I register an external data source for ES|QL data federation?”
“Can I replace the settings of an existing ES|QL data source?”
Tell an agent
Create ES|QL data source {name} of type {type}.
Set data source {name} of type {type} with settings {settings}.
DELETE /_query/data_source/{name} Delete ES|QL data sources · Delete ES|QL data sources #
Ask an LLM
“How do I remove an ES|QL federation data source?”
“Why would deleting a data source fail with a 409 conflict?”
Tell an agent destructive · confirm first
Delete ES|QL data source {name}.
Remove the federation data sources {name}.
GET /_query/dataset/{name} Get ES|QL datasets by name · Get ES|QL datasets #
Ask an LLM
“How do I look up a particular ES|QL dataset by name?”
“Can I fetch datasets using a wildcard pattern?”
Tell an agent
Get ES|QL dataset {name}.
Show the datasets matching {name}.
PUT /_query/dataset/{name} Create or update an ES|QL dataset · Create or update an ES|QL dataset #
Ask an LLM
“How do I define a dataset that points at an external data source for ES|QL?”
“Can I give an ES|QL dataset its own mappings?”
Tell an agent
Create dataset {name} on data source {data_source} for resource {resource}.
Update dataset {name} using data source {data_source}, resource {resource} and mappings {mappings}.
DELETE /_query/dataset/{name} Delete ES|QL datasets · Delete ES|QL datasets #
Ask an LLM
“How do I remove an ES|QL dataset?”
“What happens if one of the datasets I ask to delete doesn't exist?”
Tell an agent destructive · confirm first
Delete ES|QL dataset {name}.
Remove the federation datasets {name}.
GET /_query/view/{name} Get a stored ES|QL view by name · Get an ES|QL view #
Ask an LLM
“What query is behind a specific saved ES|QL view?”
“Can I fetch one ES|QL view by its name?”
Tell an agent
Get ES|QL view {name}.
Show the query stored in view {name}.
PUT /_query/view/{name} Create or update an ES|QL view · Create or update an ES|QL view #
Ask an LLM
“How do I save an ES|QL query as a reusable view?”
“Can I add a description to an ES|QL view?”
Tell an agent
Create ES|QL view {name} with query {query}.
Save view {name} for query {query} described as {description}.
DELETE /_query/view/{name} Delete a stored ES|QL view · Delete an ES|QL view #
Ask an LLM
“How do I remove a saved ES|QL view?”
“Can I delete an ES|QL view I no longer use?”
Tell an agent destructive · confirm first
Delete ES|QL view {name}.
Remove the stored view {name}.
GET /_query/data_source List all ES|QL data sources · Get ES|QL data sources #
Ask an LLM
“Which data sources are configured for ES|QL federation?”
“Can I list every ES|QL data source at once?”
Tell an agent
List all ES|QL data sources.
Show every configured federation data source.
GET /_query/dataset List all ES|QL datasets · Get ES|QL datasets #
Ask an LLM
“What ES|QL datasets exist in my cluster?”
“Can I see every federation dataset in one call?”
Tell an agent
List all ES|QL datasets.
Show every configured federation dataset.
GET /_query/queries/{id} Get details of a running ES|QL query · Get a specific running ES|QL query information #
Ask an LLM
“What is a particular running ES|QL query doing right now?”
“Can I inspect one in-flight ES|QL query by its id?”
Tell an agent
Show details of running ES|QL query {id}.
Inspect in-flight query {id}.
GET /_query/view List all stored ES|QL views · Get an ES|QL view #
Ask an LLM
“Which ES|QL views have been saved?”
“Can I list every stored ES|QL view?”
Tell an agent
List all ES|QL views.
Show every saved view.
GET /_query/queries List running ES|QL queries · Get running ES|QL queries information #
Ask an LLM
“Which ES|QL queries are currently running on the cluster?”
“Is there any long-running ES|QL query I should look at?”
Tell an agent
List running ES|QL queries.
Show all in-flight queries and their ids.
POST /_query Run an ES|QL query and get results · Run an ES|QL query #
Ask an LLM
“How do I run an ES|QL query and get the rows back right away?”
“Can I get ES|QL results as CSV or TSV?”
Tell an agent
Run ES|QL query {query}.
Run ES|QL {query} and return it as {format}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-esql-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-esql-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-esql-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Esql API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:


# --- truncated at 32 KB (384 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-esql-api-openapi.yml