Elastic Stack (ELK Stack)

Elastic Stack (ELK Stack) Fleet API

The fleet API from Elastic Stack (ELK Stack) — 4 operation(s) for fleet.

GitHub OpenAPI

Operations 7

GET /{index}/_fleet/global_checkpoints Get global checkpoints #
GET /_fleet/_fleet_msearch Run multiple Fleet searches #
POST /_fleet/_fleet_msearch Run multiple Fleet searches #
GET /{index}/_fleet/_fleet_msearch Run multiple Fleet searches #
POST /{index}/_fleet/_fleet_msearch Run multiple Fleet searches #
POST /{index}/_fleet/_fleet_search Run a Fleet search #

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-fleet-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack-fleet-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-fleet-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Fleet API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:
- name: fleet
paths:
  /{index}/_fleet/global_checkpoints:
    get:
      tags:
      - fleet
      summary: Get global checkpoints
      description: 'Get the current global checkpoints for an index.

        This API is designed for internal use by the Fleet server project.'
      operationId: fleet-global-checkpoints
      parameters:
      - in: path
        name: index
        description: A single index or index alias that resolves to a single index.
        required: true
        deprecated: false
        schema:
          oneOf:
          - $ref: '#/components/schemas/_types.IndexName'
          - $ref: '#/components/schemas/_types.IndexAlias'
        style: simple
      - in: query
        name: wait_for_advance
        description: 'A boolean value which controls whether to wait (until the timeout) for the global checkpoints

          to advance past the provided `checkpoints`.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      - in: query
        name: wait_for_index
        description: 'A boolean value which controls whether to wait (until the timeout) for the target index to exist

          and all primary shards be active. Can only be true when `wait_for_advance` is true.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      - in: query
        name: checkpoints
        description: 'A comma separated list of previous global checkpoints. When used in combination with `wait_for_advance`,

          the API will only return once the global checkpoints advances past the checkpoints. Providing an empty list

          will cause Elasticsearch to immediately return the current global checkpoints.'
        deprecated: false
        schema:
          default: []
          type: array
          items:
            $ref: '#/components/schemas/fleet._types.Checkpoint'
        style: form
      - in: query
        name: timeout
        description: Period to wait for a global checkpoints to advance past `checkpoints`.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  global_checkpoints:
                    type: array
                    items:
                      $ref: '#/components/schemas/fleet._types.Checkpoint'
                  timed_out:
                    type: boolean
                required:
                - global_checkpoints
                - timed_out
      x-state: Generally available; Added in 7.13.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
  /_fleet/_fleet_msearch:
    get:
      tags:
      - fleet
      summary: Run multiple Fleet searches
      description: 'Run several Fleet searches with a single API request.

        The API follows the same structure as the multi search API.

        However, similar to the Fleet search API, it supports the `wait_for_checkpoints` parameter.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-msearch
      parameters:
      - $ref: '#/components/parameters/fleet.msearch-allow_no_indices'
      - $ref: '#/components/parameters/fleet.msearch-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.msearch-expand_wildcards'
      - $ref: '#/components/parameters/fleet.msearch-ignore_throttled'
      - $ref: '#/components/parameters/fleet.msearch-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_searches'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.msearch-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.msearch-search_type'
      - $ref: '#/components/parameters/fleet.msearch-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.msearch-typed_keys'
      - $ref: '#/components/parameters/fleet.msearch-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.msearch-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.msearch'
      responses:
        '200':
          $ref: '#/components/responses/fleet.msearch-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
    post:
      tags:
      - fleet
      summary: Run multiple Fleet searches
      description: 'Run several Fleet searches with a single API request.

        The API follows the same structure as the multi search API.

        However, similar to the Fleet search API, it supports the `wait_for_checkpoints` parameter.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-msearch-1
      parameters:
      - $ref: '#/components/parameters/fleet.msearch-allow_no_indices'
      - $ref: '#/components/parameters/fleet.msearch-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.msearch-expand_wildcards'
      - $ref: '#/components/parameters/fleet.msearch-ignore_throttled'
      - $ref: '#/components/parameters/fleet.msearch-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_searches'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.msearch-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.msearch-search_type'
      - $ref: '#/components/parameters/fleet.msearch-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.msearch-typed_keys'
      - $ref: '#/components/parameters/fleet.msearch-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.msearch-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.msearch'
      responses:
        '200':
          $ref: '#/components/responses/fleet.msearch-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
  /{index}/_fleet/_fleet_msearch:
    get:
      tags:
      - fleet
      summary: Run multiple Fleet searches
      description: 'Run several Fleet searches with a single API request.

        The API follows the same structure as the multi search API.

        However, similar to the Fleet search API, it supports the `wait_for_checkpoints` parameter.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-msearch-2
      parameters:
      - $ref: '#/components/parameters/fleet.msearch-index'
      - $ref: '#/components/parameters/fleet.msearch-allow_no_indices'
      - $ref: '#/components/parameters/fleet.msearch-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.msearch-expand_wildcards'
      - $ref: '#/components/parameters/fleet.msearch-ignore_throttled'
      - $ref: '#/components/parameters/fleet.msearch-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_searches'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.msearch-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.msearch-search_type'
      - $ref: '#/components/parameters/fleet.msearch-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.msearch-typed_keys'
      - $ref: '#/components/parameters/fleet.msearch-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.msearch-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.msearch'
      responses:
        '200':
          $ref: '#/components/responses/fleet.msearch-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
    post:
      tags:
      - fleet
      summary: Run multiple Fleet searches
      description: 'Run several Fleet searches with a single API request.

        The API follows the same structure as the multi search API.

        However, similar to the Fleet search API, it supports the `wait_for_checkpoints` parameter.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-msearch-3
      parameters:
      - $ref: '#/components/parameters/fleet.msearch-index'
      - $ref: '#/components/parameters/fleet.msearch-allow_no_indices'
      - $ref: '#/components/parameters/fleet.msearch-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.msearch-expand_wildcards'
      - $ref: '#/components/parameters/fleet.msearch-ignore_throttled'
      - $ref: '#/components/parameters/fleet.msearch-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_searches'
      - $ref: '#/components/parameters/fleet.msearch-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.msearch-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.msearch-search_type'
      - $ref: '#/components/parameters/fleet.msearch-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.msearch-typed_keys'
      - $ref: '#/components/parameters/fleet.msearch-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.msearch-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.msearch'
      responses:
        '200':
          $ref: '#/components/responses/fleet.msearch-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
  /{index}/_fleet/_fleet_search:
    get:
      tags:
      - fleet
      summary: Run a Fleet search
      description: 'The purpose of the Fleet search API is to provide an API where the search will be run only

        after the provided checkpoint has been processed and is visible for searches inside of Elasticsearch.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-search
      parameters:
      - $ref: '#/components/parameters/fleet.search-index'
      - $ref: '#/components/parameters/fleet.search-allow_no_indices'
      - $ref: '#/components/parameters/fleet.search-analyzer'
      - $ref: '#/components/parameters/fleet.search-analyze_wildcard'
      - $ref: '#/components/parameters/fleet.search-batched_reduce_size'
      - $ref: '#/components/parameters/fleet.search-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.search-default_operator'
      - $ref: '#/components/parameters/fleet.search-df'
      - $ref: '#/components/parameters/fleet.search-docvalue_fields'
      - $ref: '#/components/parameters/fleet.search-expand_wildcards'
      - $ref: '#/components/parameters/fleet.search-explain'
      - $ref: '#/components/parameters/fleet.search-ignore_throttled'
      - $ref: '#/components/parameters/fleet.search-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.search-lenient'
      - $ref: '#/components/parameters/fleet.search-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.search-preference'
      - $ref: '#/components/parameters/fleet.search-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.search-request_cache'
      - $ref: '#/components/parameters/fleet.search-routing'
      - $ref: '#/components/parameters/fleet.search-scroll'
      - $ref: '#/components/parameters/fleet.search-search_type'
      - $ref: '#/components/parameters/fleet.search-stats'
      - $ref: '#/components/parameters/fleet.search-stored_fields'
      - $ref: '#/components/parameters/fleet.search-suggest_field'
      - $ref: '#/components/parameters/fleet.search-suggest_mode'
      - $ref: '#/components/parameters/fleet.search-suggest_size'
      - $ref: '#/components/parameters/fleet.search-suggest_text'
      - $ref: '#/components/parameters/fleet.search-terminate_after'
      - $ref: '#/components/parameters/fleet.search-timeout'
      - $ref: '#/components/parameters/fleet.search-track_total_hits'
      - $ref: '#/components/parameters/fleet.search-track_scores'
      - $ref: '#/components/parameters/fleet.search-typed_keys'
      - $ref: '#/components/parameters/fleet.search-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.search-version'
      - $ref: '#/components/parameters/fleet.search-_source'
      - $ref: '#/components/parameters/fleet.search-_source_excludes'
      - $ref: '#/components/parameters/fleet.search-_source_includes'
      - $ref: '#/components/parameters/fleet.search-seq_no_primary_term'
      - $ref: '#/components/parameters/fleet.search-q'
      - $ref: '#/components/parameters/fleet.search-size'
      - $ref: '#/components/parameters/fleet.search-from'
      - $ref: '#/components/parameters/fleet.search-sort'
      - $ref: '#/components/parameters/fleet.search-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.search-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.search'
      responses:
        '200':
          $ref: '#/components/responses/fleet.search-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
    post:
      tags:
      - fleet
      summary: Run a Fleet search
      description: 'The purpose of the Fleet search API is to provide an API where the search will be run only

        after the provided checkpoint has been processed and is visible for searches inside of Elasticsearch.


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: fleet-search-1
      parameters:
      - $ref: '#/components/parameters/fleet.search-index'
      - $ref: '#/components/parameters/fleet.search-allow_no_indices'
      - $ref: '#/components/parameters/fleet.search-analyzer'
      - $ref: '#/components/parameters/fleet.search-analyze_wildcard'
      - $ref: '#/components/parameters/fleet.search-batched_reduce_size'
      - $ref: '#/components/parameters/fleet.search-ccs_minimize_roundtrips'
      - $ref: '#/components/parameters/fleet.search-default_operator'
      - $ref: '#/components/parameters/fleet.search-df'
      - $ref: '#/components/parameters/fleet.search-docvalue_fields'
      - $ref: '#/components/parameters/fleet.search-expand_wildcards'
      - $ref: '#/components/parameters/fleet.search-explain'
      - $ref: '#/components/parameters/fleet.search-ignore_throttled'
      - $ref: '#/components/parameters/fleet.search-ignore_unavailable'
      - $ref: '#/components/parameters/fleet.search-lenient'
      - $ref: '#/components/parameters/fleet.search-max_concurrent_shard_requests'
      - $ref: '#/components/parameters/fleet.search-preference'
      - $ref: '#/components/parameters/fleet.search-pre_filter_shard_size'
      - $ref: '#/components/parameters/fleet.search-request_cache'
      - $ref: '#/components/parameters/fleet.search-routing'
      - $ref: '#/components/parameters/fleet.search-scroll'
      - $ref: '#/components/parameters/fleet.search-search_type'
      - $ref: '#/components/parameters/fleet.search-stats'
      - $ref: '#/components/parameters/fleet.search-stored_fields'
      - $ref: '#/components/parameters/fleet.search-suggest_field'
      - $ref: '#/components/parameters/fleet.search-suggest_mode'
      - $ref: '#/components/parameters/fleet.search-suggest_size'
      - $ref: '#/components/parameters/fleet.search-suggest_text'
      - $ref: '#/components/parameters/fleet.search-terminate_after'
      - $ref: '#/components/parameters/fleet.search-timeout'
      - $ref: '#/components/parameters/fleet.search-track_total_hits'
      - $ref: '#/components/parameters/fleet.search-track_scores'
      - $ref: '#/components/parameters/fleet.search-typed_keys'
      - $ref: '#/components/parameters/fleet.search-rest_total_hits_as_int'
      - $ref: '#/components/parameters/fleet.search-version'
      - $ref: '#/components/parameters/fleet.search-_source'
      - $ref: '#/components/parameters/fleet.search-_source_excludes'
      - $ref: '#/components/parameters/fleet.search-_source_includes'
      - $ref: '#/components/parameters/fleet.search-seq_no_primary_term'
      - $ref: '#/components/parameters/fleet.search-q'
      - $ref: '#/components/parameters/fleet.search-size'
      - $ref: '#/components/parameters/fleet.search-from'
      - $ref: '#/components/parameters/fleet.search-sort'
      - $ref: '#/components/parameters/fleet.search-wait_for_checkpoints'
      - $ref: '#/components/parameters/fleet.search-allow_partial_search_results'
      requestBody:
        $ref: '#/components/requestBodies/fleet.search'
      responses:
        '200':
          $ref: '#/components/responses/fleet.search-200'
      x-state: Experimental; Added in 7.16.0
      x-metaTags:
      - content: Elasticsearch, Fleet
        name: product_name
components:
  schemas:
    _types.query_dsl.SpanContainingQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          big:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
          little:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
        required:
        - big
        - little
    _types.query_dsl.TypeQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          value:
            type: string
        required:
        - value
    _types.aggregations.SignificantTermsAggregateBaseSignificantStringTermsBucket:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseSignificantStringTermsBucket'
      - type: object
        properties:
          bg_count:
            type: number
          doc_count:
            type: number
    _types.aggregations.TopHitsAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase'
      - type: object
        properties:
          docvalue_fields:
            description: Fields for which to return doc values.
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          explain:
            description: If `true`, returns detailed information about score computation as part of a hit.
            default: false
            type: boolean
          fields:
            description: 'Array of wildcard (*) patterns. The request returns values for field names

              matching these patterns in the hits.fields property of the response.'
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          from:
            description: Starting document offset.
            default: 0.0
            type: number
          highlight:
            description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.Highlight'
          script_fields:
            description: Returns the result of one or more script evaluations for each hit.
            type: object
            additionalProperties:
              $ref: '#/components/schemas/_types.ScriptField'
          size:
            description: The maximum number of top matching hits to return per bucket.
            default: 3.0
            type: number
          sort:
            description: 'Sort order of the top matching hits.

              By default, the hits are sorted by the score of the main query.'
            allOf:
            - $ref: '#/components/schemas/_types.Sort'
          _source:
            description: Selects the fields of the source that are returned.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.SourceConfig'
          stored_fields:
            description: Returns values for the specified stored fields (fields that use the `store` mapping option).
            allOf:
            - $ref: '#/components/schemas/_types.Fields'
          track_scores:
            description: If `true`, calculates and returns document scores, even if the scores are not used for sorting.
            default: false
            type: boolean
          version:
            description: If `true`, returns document version as part of a hit.
            default: false
            type: boolean
          seq_no_primary_term:
            description: If `true`, returns sequence number and primary term of the last modification of each hit.
            type: boolean
    _types.query_dsl.CombinedFieldsZeroTerms:
      type: string
      enum:
      - none
      - all
    _types.aggregations.BucketSelectorAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
        properties:
          script:
            description: The script to run for this aggregation.
            allOf:
            - $ref: '#/components/schemas/_types.Script'
    _types.aggregations.TermsPartition:
      type: object
      properties:
        num_partitions:
          description: The number of partitions.
          type: number
        partition:
          description: The partition number for this request.
          type: number
      required:
      - num_partitions
      - partition
    _types.query_dsl.GeoBoundingBoxQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          type:
            deprecated: true
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoExecution'
          validation_method:
            description: 'Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude.

              Set to `COERCE` to also try to infer correct latitude or longitude.'
            default: '''strict'''
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod'
          ignore_unmapped:
            description: 'Set to `true` to ignore an unmapped field and not match any documents for this query.

              Set to `false` to throw an exception if the field is not mapped.'
            default: false
            type: boolean
    _types.SortResults:
      type: array
      items:
        $ref: '#/components/schemas/_types.FieldValue'
    _types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator:
      type: object
      properties:
        doc_count:
          description: 'The total number of documents that initially created the expectations. It’s required to be greater

            than or equal to the sum of all values in the buckets_path as this is the originating superset of data

            to which the term values are correlated.'
          type: number
        expectations:
          description: 'An array of numbers with which to correlate the configured `bucket_path` values.

            The length of this value must always equal the number of buckets returned by the `bucket_path`.'
          type: array
          items:
            type: number
        fractions:
          description: 'An array of fractions to use when averaging and calculating variance. This should be used if

            the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided,

            must equal expectations.'
          type: array
          items:
            type: number
      required:
      - doc_count
      - expectations
    _types.aggregations.IpRangeAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseIpRangeBucket'
      - type: object
    _types.aggregations.LongRareTermsAggregate:
      description: Result of the `rare_terms` aggregation when the field is some kind of whole number like a integer, long, or a date.
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseLongRareTermsBucket'
      - type: object
    _types.aggregations.ChildrenAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          type:
            description: The child type that should be selected.
            allOf:
            - $ref: '#/components/schemas/_types.RelationName'
    _types.EpochTimeUnitMillis:
      allOf:
      - $ref: '#/components/schemas/_types.UnitMillis'
    _types.aggregations.TimeSeriesAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseTimeSeriesBucket'
      - type: object
    _types.aggregations.MatrixAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.Aggregation'
      - type: object
        properties:
          fields:
            description: An array of fields for computing the statistics.
            allOf:
            - $ref: '#/components/schemas/_types.Fields'
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            type: object
            additionalProperties:
              type: number
    _types.aggregations.MultiBucketAggregateBaseMultiTermsBucket:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.AggregateBase'
      - type: object
        properties:
          buckets:
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.BucketsMultiTermsBucket'
        required:
        - buckets
    _types.aggregations.ReverseNestedAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.SingleBucketAggregateBase'
      - type: object
    _types.aggregations.MultiBucketBase:
      description: Base type for multi-bucket aggregation results that can hold sub-aggregations results.
      type: object
      properties:
        doc_count:
          type: number
      required:
      - doc_count
    _types.aggregations.BucketsMultiTermsBucket:
      description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for

        the different buckets, the result is a dictionary.'
      oneOf:
      - type: object
        additionalProperties:
          $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket'
      - type: array
        items:
          $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket'
    _types.query_dsl.DisMaxQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          queries:
            description: 'One or more query clauses.

              Returned documents must match one or more of these queries.

              If a document matches multiple queries, Elasticsearch uses the highest relevance score.'
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.QueryContainer'
          tie_breaker:
            description: Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses.
            default: 0.0
            type: number
        required:
        - queries
    _types.aggregations.SamplerAggregationExecutionHint:
      type: string
      enum:
      - map
      - global_ordinals
      - bytes_hash
    _types.aggregations.MovingPercentilesAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
        properties:
          window:
            description: The size of window to "slide" across the histogram.
            type: number
          shift:
            description: 'By default, the window consists of the last n values excluding the current bucket.

              Increasing `shift` by 1, moves the starting window position by 1 to the right.'
            default: 0.0
            type: number
          keyed:
            type: boolean
    _types.aggregations.HoltWintersModelSettings:
      type: object
      properties:
        alpha:
          type: number
        beta:
          type: number
        gamma:
          type: number
        pad:
          type: boolean
        period:
          type: number
        type:
          allOf:
          - $ref: '#/components/schemas/_types.aggregations.HoltWintersType'
    _types.aggregations.HistogramAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          extended_bounds:
            description: Enables extending the bounds of the histogram beyond the data itself.
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble'
          hard_bounds:
            description: 'Limits the range of buckets in the histogram.

              It is particularly useful in the case of open data ranges that can result in a very large number of buckets.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble'
          field:
            description: The name of the field to aggregate on.
            allOf:
            - $ref: '#/components/schemas/_types.Field'
          interval:
            description: 'The interval for the buckets.

              Must be a positive decimal.'
            type: number
          min_doc_count:
            description: 'Only returns buckets that have `min_doc_count` number of documents.

              By default, the response will fill gaps in the histogram with empty buckets.'
            type: number
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            type: number
          offset:
            description: 'By default, the bucket keys start with 0 and then continue in even spaced steps of `interval`.

              The bucket boundaries can be shifted by using the `offset` option.'
            type: number
          order:
            description: 'The sort order of the returned buckets.

              By default, the returned buckets are sorted by their key ascending.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.AggregateOrder'
          script:
            allOf:
            - $ref: '#/components/schemas/_types.Script'
          format:
            type: string
          keyed:
            description: If `true`, returns buckets as a hash instead of an array, keyed by the bucket keys.
            default: false
            type: boolean
    _types.GeoTilePrecision:
      type: number
    _types.aggregations.DateRangeAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          field:
            description: The date field whose values are use to build ranges.
            allOf:
            - $ref: '#/components/schemas/_types.Field'
          format:
            description: The date format used to format `from` and `to` in the response.
            type: string
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.Missing'
          ranges:
            description: Array of date ranges.
            type: array
            items:
              $ref: '#/components/schemas/_types.aggregations.DateRangeExpression'
         

# --- truncated at 32 KB (462 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-fleet-api-openapi.yml