Run an async SQL search

By default, SQL searches are synchronous. They wait for complete results before returning a response. However, results can take longer for searches across large data sets or frozen data.

To avoid long waits, run an async SQL search. Set wait_for_completion_timeout to a duration you’d like to wait for synchronous results.

  1. POST _sql?format=json
  2. {
  3.   "wait_for_completion_timeout": "2s",
  4.   "query": "SELECT * FROM library ORDER BY page_count DESC",
  5.   "fetch_size": 5
  6. }

If the search doesn’t finish within this period, the search becomes async. The API returns:

  • An id for the search.
  • An is_partial value of true, indicating the search results are incomplete.
  • An is_running value of true, indicating the search is still running in the background.

For CSV, TSV, and TXT responses, the API returns these values in the respective Async-ID, Async-partial, and Async-running HTTP headers instead.

  1. {
  2.   "id": "FnR0TDhyWUVmUmVtWXRWZER4MXZiNFEad2F5UDk2ZVdTVHV1S0xDUy00SklUdzozMTU=",
  3.   "is_partial": true,
  4.   "is_running": true,
  5.   "rows": [ ]
  6. }

To check the progress of an async search, use the search ID with the get async SQL search status API.

  1. GET _sql/async/status/FnR0TDhyWUVmUmVtWXRWZER4MXZiNFEad2F5UDk2ZVdTVHV1S0xDUy00SklUdzozMTU=

If is_running and is_partial are false, the async search has finished with complete results.

  1. {
  2.   "id": "FnR0TDhyWUVmUmVtWXRWZER4MXZiNFEad2F5UDk2ZVdTVHV1S0xDUy00SklUdzozMTU=",
  3.   "is_running": false,
  4.   "is_partial": false,
  5.   "expiration_time_in_millis": 1611690295000,
  6.   "completion_status": 200
  7. }

To get the results, use the search ID with the get async SQL search API. If the search is still running, specify how long you’d like to wait using wait_for_completion_timeout. You can also specify the response format.

  1. GET _sql/async/FnR0TDhyWUVmUmVtWXRWZER4MXZiNFEad2F5UDk2ZVdTVHV1S0xDUy00SklUdzozMTU=?wait_for_completion_timeout=2s&format=json

Change the search retention period

By default, Elasticsearch stores async SQL searches for five days. After this period, Elasticsearch deletes the search and its results, even if the search is still running. To change this retention period, use the keep_alive parameter.

  1. POST _sql?format=json
  2. {
  3.   "keep_alive": "2d",
  4.   "wait_for_completion_timeout": "2s",
  5.   "query": "SELECT * FROM library ORDER BY page_count DESC",
  6.   "fetch_size": 5
  7. }

You can use the get async SQL search API’s keep_alive parameter to later change the retention period. The new period starts after the request runs.

  1. GET _sql/async/FmdMX2pIang3UWhLRU5QS0lqdlppYncaMUpYQ05oSkpTc3kwZ21EdC1tbFJXQToxOTI=?keep_alive=5d&wait_for_completion_timeout=2s&format=json

Use the delete async SQL search API to delete an async search before the keep_alive period ends. If the search is still running, Elasticsearch cancels it.

  1. DELETE _sql/async/delete/FmdMX2pIang3UWhLRU5QS0lqdlppYncaMUpYQ05oSkpTc3kwZ21EdC1tbFJXQToxOTI=

Store synchronous SQL searches

By default, Elasticsearch only stores async SQL searches. To save a synchronous search, specify wait_for_completion_timeout and set keep_on_completion to true.

  1. POST _sql?format=json
  2. {
  3.   "keep_on_completion": true,
  4.   "wait_for_completion_timeout": "2s",
  5.   "query": "SELECT * FROM library ORDER BY page_count DESC",
  6.   "fetch_size": 5
  7. }

If is_partial and is_running are false, the search was synchronous and returned complete results.

  1. {
  2.   "id": "Fnc5UllQdUVWU0NxRFNMbWxNYXplaFEaMUpYQ05oSkpTc3kwZ21EdC1tbFJXQTo0NzA=",
  3.   "is_partial": false,
  4.   "is_running": false,
  5.   "rows": ...,
  6.   "columns": ...,
  7.   "cursor": ...
  8. }

You can get the same results later using the search ID with the get async SQL search API.

Saved synchronous searches are still subject to the keep_alive retention period. When this period ends, Elasticsearch deletes the search results. You can also delete saved searches using the delete async SQL search API.