---
title: "Execute ESQL Query"
method: POST
path: "/v1/siem/query"
tags: ["SIEM"]
---

# Execute ESQL Query

`POST /v1/siem/query`

Execute an ESQL query against your SIEM logs and receive paginated JSON results.

This endpoint uses POST so that the ESQL query string can be sent in the request body
rather than as a URL query parameter, avoiding URL length limits for complex queries.

Queries must begin with `FROM logs`. Results are limited to 200 rows per page.
If `next_page_token` is present, pass it as `page_token` in a subsequent request
(with the same `range_start` and `range_end`) to retrieve the next page.

**Response**

Returns a JSON object with two top-level keys:

- `logs` — Array of objects. Each object represents one log record. Keys are ECS field
  names (e.g. `event.provider`, `host.hostname`). The fields present depend on the columns
  selected by your ESQL query (e.g. a `KEEP` command). With no column selection, all
  available ECS fields are returned.

- `pagination` — Object. Contains `next_page_token` (string) when additional results are
  available; empty object `{}` when all results have been returned. Pass `next_page_token`
  as `page_token` in your next request to retrieve the following page.

## Request body

- PostV1SiemQuery — Execute ESQL Query
  - `esql` string, required — ESQL query string (must begin with FROM logs)
  - `range_start` string, date-time, required — Query range start (ISO 8601)
  - `range_end` string, date-time, required — Query range end (ISO 8601)
  - `page_token` string — Pagination token from previous response

## Response `200`

Query executed successfully.

- SiemQueryResult — SiemQueryResult model
  - `logs` object[] — Array of log records. Keys are Elastic Common Schema (ECS) field names (e.g. `event.provider`, `host.hostname`). The fields present depend on the columns selected by your ESQL query. With no column selection, all available ECS fields are returned.
  - `pagination` SiemPagination
    - `next_page_token` string — Token to retrieve the next page of results. Omitted when all results have been returned.

## Other responses

- `400` — Missing or invalid request parameters.
- `401` — Authentication credentials are missing or invalid.
- `404` — SIEM query feature is not enabled for this account.
- `408` — Query timed out.
- `413` — Query exceeded memory limit.
- `422` — Invalid ESQL query or query parameters.

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)