Elastic Stack (ELK Stack) Search Application API

openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Search Application API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:
- name: search_application
paths:
  /_application/search_application/{name}:
    get:
      tags:
      - search_application
      summary: Get search application details
      description: '


        ## Required authorization


        * Cluster privileges: `manage_search_application`

        '
      operationId: search-application-get
      parameters:
      - in: path
        name: name
        description: The name of the search application
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/search_application._types.SearchApplication'
              examples:
                SearchApplicationGetResponseExample1:
                  description: A sucessful response from `GET _application/search_application/my-app/`.
                  value: "{\n  \"name\": \"my-app\",\n  \"indices\": [ \"index1\", \"index2\" ],\n  \"updated_at_millis\": 1682105622204,\n  \"template\": {\n    \"script\": {\n      \"source\": {\n        \"query\": {\n          \"query_string\": {\n            \"query\": \"{{query_string}}\",\n            \"default_field\": \"{{default_field}}\"\n          }\n        }\n      },\n      \"lang\": \"mustache\",\n      \"options\": {\n        \"content_type\": \"application/json;charset=utf-8\"\n      },\n      \"params\": {\n        \"query_string\": \"*\",\n        \"default_field\": \"*\"\n      }\n    }\n  }\n}"
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - search_application
      summary: Create or update a search application
      description: '


        ## Required authorization


        * Index privileges: `manage`

        * Cluster privileges: `manage_search_application`

        '
      operationId: search-application-put
      parameters:
      - in: path
        name: name
        description: The name of the search application to be created or updated.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      - in: query
        name: create
        description: If `true`, this request cannot replace or update existing Search Applications.
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/search_application._types.SearchApplicationParameters'
            examples:
              SearchApplicationPutRequestExample1:
                description: 'Run `PUT _application/search_application/my-app` to create or update a search application called `my-app`. When the  dictionary parameter is specified, the search application search API will perform the following parameter validation: it accepts only the `query_string` and `default_field` parameters; it verifies that `query_string` and `default_field` are both strings; it accepts `default_field` only if it takes the values title or description. If the parameters are not valid, the search application search API will return an error.

                  '
                value: "{\n  \"indices\": [ \"index1\", \"index2\" ],\n  \"template\": {\n    \"script\": {\n      \"source\": {\n        \"query\": {\n          \"query_string\": {\n            \"query\": \"{{query_string}}\",\n            \"default_field\": \"{{default_field}}\"\n          }\n        }\n      },\n      \"params\": {\n        \"query_string\": \"*\",\n        \"default_field\": \"*\"\n      }\n    },\n    \"dictionary\": {\n      \"properties\": {\n        \"query_string\": {\n          \"type\": \"string\"\n        },\n        \"default_field\": {\n          \"type\": \"string\",\n          \"enum\": [\n            \"title\",\n            \"description\"\n          ]\n        },\n        \"additionalProperties\": false\n      },\n      \"required\": [\n        \"query_string\"\n      ]\n    }\n  }\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    allOf:
                    - $ref: '#/components/schemas/_types.Result'
                required:
                - result
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - search_application
      summary: Delete a search application
      description: 'Remove a search application and its associated alias. Indices attached to the search application are not removed.


        ## Required authorization


        * Index privileges: `manage`

        * Cluster privileges: `manage_search_application`

        '
      operationId: search-application-delete
      parameters:
      - in: path
        name: name
        description: The name of the search application to delete.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_application/search_application:
    get:
      tags:
      - search_application
      summary: Get search applications
      description: 'Get information about search applications.


        ## Required authorization


        * Cluster privileges: `manage_search_application`

        '
      operationId: search-application-list
      parameters:
      - in: query
        name: q
        description: Query in the Lucene query string syntax.
        deprecated: false
        schema:
          type: string
        style: form
      - in: query
        name: from
        description: Starting offset.
        deprecated: false
        schema:
          default: 0.0
          type: number
        style: form
      - in: query
        name: size
        description: Specifies a max number of results to get.
        deprecated: false
        schema:
          type: number
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  count:
                    type: number
                  results:
                    type: array
                    items:
                      $ref: '#/components/schemas/search_application._types.SearchApplication'
                required:
                - count
                - results
              examples:
                SearchApplicationsListResponseExample1:
                  description: A succesful response from `GET _application/search_application?from=0&size=3&q=app*` returns the first three search applications whose names start with `app`.
                  value: "{\n  \"count\": 2,\n  \"results\": [\n    {\n      \"name\": \"app-1\",\n      \"updated_at_millis\": 1690981129366\n    },\n    {\n      \"name\": \"app-2\",\n      \"updated_at_millis\": 1691501823939\n    }\n  ]\n}"
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_application/search_application/{name}/_render_query:
    post:
      tags:
      - search_application
      summary: Render a search application query
      description: 'Generate an Elasticsearch query using the specified query parameters and the search template associated with the search application or a default template if none is specified.

        If a parameter used in the search template is not specified in `params`, the parameter''s default value will be used.

        The API returns the specific Elasticsearch query that would be generated and run by calling the search application search API.


        You must have `read` privileges on the backing alias of the search application.'
      operationId: search-application-render-query
      parameters:
      - in: path
        name: name
        description: The name of the search application to render teh query for.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Name'
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                params:
                  type: object
                  additionalProperties:
                    type: object
            examples:
              SearchApplicationsRenderQueryRequestExample1:
                description: Run `POST _application/search_application/my-app/_render_query` to generate a query for a search application called `my-app` that uses the search template.
                value: "{\n  \"params\": {\n    \"query_string\": \"my first query\",\n    \"text_fields\": [\n      {\n        \"name\": \"title\",\n        \"boost\": 5\n      },\n      {\n        \"name\": \"description\",\n        \"boost\": 1\n      }\n    ]\n  }\n}"
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
              examples:
                SearchApplicationsRenderQueryResponseExample1:
                  description: A successful response for generating a query for a search application. The `from`, `size`, and `explain` parameters were not specified in the request, so the default values specified in the search template are used.
                  value: "{\n  \"from\": 0,\n  \"size\": 10,\n  \"query\": {\n    \"multi_match\": {\n      \"query\": \"my first query\",\n      \"fields\": [\n        \"description^1.0\",\n        \"title^5.0\"\n      ]\n    }\n  },\n  \"explain\": false\n}"
      x-state: Experimental; Added in 8.9.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_application/search_application/{name}/_search:
    get:
      tags:
      - search_application
      summary: Run a search application search
      description: 'Generate and run an Elasticsearch query that uses the specified query parameteter and the search template associated with the search application or default template.

        Unspecified template parameters are assigned their default values if applicable.'
      operationId: search-application-search
      parameters:
      - $ref: '#/components/parameters/search_application.search-name'
      - $ref: '#/components/parameters/search_application.search-typed_keys'
      requestBody:
        $ref: '#/components/requestBodies/search_application.search'
      responses:
        '200':
          $ref: '#/components/responses/search_application.search-200'
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - search_application
      summary: Run a search application search
      description: 'Generate and run an Elasticsearch query that uses the specified query parameteter and the search template associated with the search application or default template.

        Unspecified template parameters are assigned their default values if applicable.'
      operationId: search-application-search-1
      parameters:
      - $ref: '#/components/parameters/search_application.search-name'
      - $ref: '#/components/parameters/search_application.search-typed_keys'
      requestBody:
        $ref: '#/components/requestBodies/search_application.search'
      responses:
        '200':
          $ref: '#/components/responses/search_application.search-200'
      x-state: Beta; Added in 8.8.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
components:
  schemas:
    _types.query_dsl.SpanContainingQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          big:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
          little:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
        required:
        - big
        - little
    _types.query_dsl.TypeQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          value:
            type: string
        required:
        - value
    _types.aggregations.SignificantTermsAggregateBaseSignificantStringTermsBucket:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseSignificantStringTermsBucket'
      - type: object
        properties:
          bg_count:
            type: number
          doc_count:
            type: number
    _types.aggregations.TopHitsAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase'
      - type: object
        properties:
          docvalue_fields:
            description: Fields for which to return doc values.
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          explain:
            description: If `true`, returns detailed information about score computation as part of a hit.
            default: false
            type: boolean
          fields:
            description: 'Array of wildcard (*) patterns. The request returns values for field names

              matching these patterns in the hits.fields property of the response.'
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          from:
            description: Starting document offset.
            default: 0.0
            type: number
          highlight:
            description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.Highlight'
          script_fields:
            description: Returns the result of one or more script evaluations for each hit.
            type: object
            additionalProperties:
              $ref: '#/components/schemas/_types.ScriptField'
          size:
            description: The maximum number of top matching hits to return per bucket.
            default: 3.0
            type: number
          sort:
            description: 'Sort order of the top matching hits.

              By default, the hits are sorted by the score of the main query.'
            allOf:
            - $ref: '#/components/schemas/_types.Sort'
          _source:
            description: Selects the fields of the source that are returned.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.SourceConfig'
          stored_fields:
            description: Returns values for the specified stored fields (fields that use the `store` mapping option).
            allOf:
            - $ref: '#/components/schemas/_types.Fields'
          track_scores:
            description: If `true`, calculates and returns document scores, even if the scores are not used for sorting.
            default: false
            type: boolean
          version:
            description: If `true`, returns document version as part of a hit.
            default: false
            type: boolean
          seq_no_primary_term:
            description: If `true`, returns sequence number and primary term of the last modification of each hit.
            type: boolean
    _types.query_dsl.CombinedFieldsZeroTerms:
      type: string
      enum:
      - none
      - all
    _types.aggregations.BucketSelectorAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
        properties:
          script:
            description: The script to run for this aggregation.
            allOf:
            - $ref: '#/components/schemas/_types.Script'
    _types.aggregations.TermsPartition:
      type: object
      properties:
        num_partitions:
          description: The number of partitions.
          type: number
        partition:
          description: The partition number for this request.
          type: number
      required:
      - num_partitions
      - partition
    _types.query_dsl.GeoBoundingBoxQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          type:
            deprecated: true
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoExecution'
          validation_method:
            description: 'Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude.

              Set to `COERCE` to also try to infer correct latitude or longitude.'
            default: '''strict'''
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod'
          ignore_unmapped:
            description: 'Set to `true` to ignore an unmapped field and not match any documents for this query.

              Set to `false` to throw an exception if the field is not mapped.'
            default: false
            type: boolean
    _types.SortResults:
      type: array
      items:
        $ref: '#/components/schemas/_types.FieldValue'
    _types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator:
      type: object
      properties:
        doc_count:
          description: 'The total number of documents that initially created the expectations. It’s required to be greater

            than or equal to the sum of all values in the buckets_path as this is the originating superset of data

            to which the term values are correlated.'
          type: number
        expectations:
          description: 'An array of numbers with which to correlate the configured `bucket_path` values.

            The length of this value must always equal the number of buckets returned by the `bucket_path`.'
          type: array
          items:
            type: number
        fractions:
          description: 'An array of fractions to use when averaging and calculating variance. This should be used if

            the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided,

            must equal expectations.'
          type: array
          items:
            type: number
      required:
      - doc_count
      - expectations
    _types.aggregations.IpRangeAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseIpRangeBucket'
      - type: object
    _types.aggregations.LongRareTermsAggregate:
      description: Result of the `rare_terms` aggregation when the field is some kind of whole number like a integer, long, or a date.
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseLongRareTermsBucket'
      - type: object
    _types.aggregations.ChildrenAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          type:
            description: The child type that should be selected.
            allOf:
            - $ref: '#/components/schemas/_types.RelationName'
    _types.EpochTimeUnitMillis:
      allOf:
      - $ref: '#/components/schemas/_types.UnitMillis'
    _types.aggregations.TimeSeriesAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseTimeSeriesBucket'
      - type: object
    _types.aggregations.MatrixAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.Aggregation'
      - type: object
        properties:
          fields:
            description: An array of fields for computing the statistics.
            allOf:
            - $ref: '#/components/schemas/_types.Fields'
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            type: object
            additionalProperties:
              type: number
    _types.aggregations.MultiBucketAggregateBaseMultiTermsBucket:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.AggregateBase'
      - type: object
        properties:
          buckets:
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.BucketsMultiTermsBucket'
        required:
        - buckets
    _types.aggregations.ReverseNestedAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.SingleBucketAggregateBase'
      - type: object
    _types.aggregations.MultiBucketBase:
      description: Base type for multi-bucket aggregation results that can hold sub-aggregations results.
      type: object
      properties:
        doc_count:
          type: number
      required:
      - doc_count
    _types.aggregations.BucketsMultiTermsBucket:
      description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for

        the different buckets, the result is a dictionary.'
      oneOf:
      - type: object
        additionalProperties:
          $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket'
      - type: array
        items:
          $ref: '#/components/schemas/_types.aggregations.MultiTermsBucket'
    _types.query_dsl.DisMaxQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          queries:
            description: 'One or more query clauses.

              Returned documents must match one or more of these queries.

              If a document matches multiple queries, Elasticsearch uses the highest relevance score.'
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.QueryContainer'
          tie_breaker:
            description: Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses.
            default: 0.0
            type: number
        required:
        - queries
    _types.aggregations.SamplerAggregationExecutionHint:
      type: string
      enum:
      - map
      - global_ordinals
      - bytes_hash
    _types.aggregations.MovingPercentilesAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
        properties:
          window:
            description: The size of window to "slide" across the histogram.
            type: number
          shift:
            description: 'By default, the window consists of the last n values excluding the current bucket.

              Increasing `shift` by 1, moves the starting window position by 1 to the right.'
            default: 0.0
            type: number
          keyed:
            type: boolean
    _types.aggregations.HoltWintersModelSettings:
      type: object
      properties:
        alpha:
          type: number
        beta:
          type: number
        gamma:
          type: number
        pad:
          type: boolean
        period:
          type: number
        type:
          allOf:
          - $ref: '#/components/schemas/_types.aggregations.HoltWintersType'
    _types.aggregations.HistogramAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          extended_bounds:
            description: Enables extending the bounds of the histogram beyond the data itself.
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble'
          hard_bounds:
            description: 'Limits the range of buckets in the histogram.

              It is particularly useful in the case of open data ranges that can result in a very large number of buckets.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble'
          field:
            description: The name of the field to aggregate on.
            allOf:
            - $ref: '#/components/schemas/_types.Field'
          interval:
            description: 'The interval for the buckets.

              Must be a positive decimal.'
            type: number
          min_doc_count:
            description: 'Only returns buckets that have `min_doc_count` number of documents.

              By default, the response will fill gaps in the histogram with empty buckets.'
            type: number
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            type: number
          offset:
            description: 'By default, the bucket keys start with 0 and then continue in even spaced steps of `interval`.

              The bucket boundaries can be shifted by using the `offset` option.'
            type: number
          order:
            description: 'The sort order of the returned buckets.

              By default, the returned buckets are sorted by their key ascending.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.AggregateOrder'
          script:
            allOf:
            - $ref: '#/components/schemas/_types.Script'
          format:
            type: string
          keyed:
            description: If `true`, returns buckets as a hash instead of an array, keyed by the bucket keys.
            default: false
            type: boolean
    _types.GeoTilePrecision:
      type: number
    _types.aggregations.DateRangeAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          field:
            description: The date field whose values are use to build ranges.
            allOf:
            - $ref: '#/components/schemas/_types.Field'
          format:
            description: The date format used to format `from` and `to` in the response.
            type: string
          missing:
            description: 'The value to apply to documents that do not have a value.

              By default, documents without a value are ignored.'
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.Missing'
          ranges:
            description: Array of date ranges.
            type: array
            items:
              $ref: '#/components/schemas/_types.aggregations.DateRangeExpression'
          time_zone:
            description: Time zone used to convert dates from another time zone to UTC.
            allOf:
            - $ref: '#/components/schemas/_types.TimeZone'
          keyed:
            description: Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array.
            type: boolean
    _types.aggregations.PercentilesAggregateBase:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.AggregateBase'
      - type: object
        properties:
          values:
            allOf:
            - $ref: '#/components/schemas/_types.aggregations.Percentiles'
        required:
        - values
    _types.aggregations.StringStatsAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase'
      - type: object
        properties:
          show_distribution:
            description: Shows the probability distribution for all characters.
            default: false
            type: boolean
    _types.aggregations.TTestType:
      type: string
      enum:
      - paired
      - homoscedastic
      - heteroscedastic
    _types.TextSimilarityReranker:
      allOf:
      - $ref: '#/components/schemas/_types.RetrieverBase'
      - type: object
        properties:
          retriever:
            description: The nested retriever which will produce the first-level results, that will later be used for reranking.
            allOf:
            - $ref: '#/components/schemas/_types.RetrieverContainer'
          rank_window_size:
            description: This value determines how many documents we will consider from the nested retriever.
            type: number
          inference_id:
            description: Unique identifier of the inference endpoint created using the inference API.
            type: string
          inference_text:
            description: The text snippet used as the basis for similarity comparison.
            type: string
          field:
            description: The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text.
            type: string
          chunk_rescorer:
            description: Whether to rescore on only the best matching chunks.
            x-state: Generally available; Added in 9.2.0
            allOf:
            - $ref: '#/components/schemas/_types.ChunkRescorer'
        required:
        - retriever
        - inference_text
        - field
    _types.aggregations.ParentAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          type:
            description: The child type that should be selected.
            allOf:
            - $ref: '#/components/schemas/_types.RelationName'
    _types.aggregations.MaxBucketAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
    _global.search._types.FieldCollapse:
      type: object
      properties:
        field:
          description: The field to collapse the result set on
          allOf:
          - $ref: '#/components/schemas/_types.Field'
        inner_hits:
          description: The number of inner hits and their sort order
          oneOf:
          - $ref: '#/components/schemas/_global.search._types.InnerHits'
          - type: array
            items:
              $ref: '#/components/schemas/_global.search._types.InnerHits'
        max_concurrent_group_searches:
          description: The number of concurrent requests allowed to retrieve the inner_hits per group
          type: number
        collapse:
          allOf:
          - $ref: '#/components/schemas/_global.search._types.FieldCollapse'
      required:
      - field
    _types.DateTime:
      description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a

        number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string

        representation.'
      oneOf:
      - type: string
      - $ref: '#/components/schemas/_types.EpochTimeUnitMillis'
    _types.query_dsl.RangeQueryBase:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          relation:
            description: Indicates how the range query matches values for `range` fields.
            default: intersects
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.RangeRelation'
          gt:
            description: Greater than.
            type: object
          gte:
            description: Greater than or equal to.
            type: object
          lt:
            description: Less than.
            type: object
          lte:
            description: Less than or equal to.
            type: object
    _types.query_dsl.Numeri

# --- truncated at 32 KB (432 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-search-application-api-openapi.yml