Execute ESQL Query

Execute an ESQL query against your SIEM logs and receive paginated JSON results.

This endpoint uses POST so that the ESQL query string can be sent in the request body rather than as a URL query parameter, avoiding URL length limits for complex queries.

Queries must begin with FROM logs. Results are limited to 200 rows per page. If next_page_token is present, pass it as page_token in a subsequent request (with the same range_start and range_end) to retrieve the next page.

Response

Returns a JSON object with two top-level keys:

• logs — Array of objects. Each object represents one log record. Keys are ECS field names (e.g. event.provider, host.hostname). The fields present depend on the columns selected by your ESQL query (e.g. a KEEP command). With no column selection, all available ECS fields are returned.

• pagination — Object. Contains next_page_token (string) when additional results are available; empty object {} when all results have been returned. Pass next_page_token as page_token in your next request to retrieve the following page.

{
  "logs": [
    {
      "uuid": "019612ab-1234-7000-8000-000000000001",
      "event.provider": "Microsoft-Windows-Security-Auditing",
      "host.hostname": "DESKTOP-ABC123",
      "message": "An account was successfully logged on."
    }
  ],
  "pagination": {
    "next_page_token": "019612ab-1234-7000-8000-000000000001"
  }
}