There’s nothing like starting a new week — not to mention the new year — with new product-related announcements! In this case, I’m happy to inform our users of a new Search API that will enable them to safely and securely query the data that they are shipping to using the Elasticsearch Search API DSL.

This API replaces the older Query API, which was much more limited in scope and capabilities and will be deprecated in a few months.

Why would you use the API to query Elasticsearch instead of Kibana? Well, you could, for example, integrate with the API to create some kind of baseline for monitoring new services. As soon as a new service or host registers, you could use the API to match which of them are logging into Elasticsearch.

Below are some general guidelines on the API along with explanations of existing limitations and one simple example of how to use it.

For the most updated instruction on using the API, please refer to the documentation.

Licensing and Limitations

For now, only our Enterprise users will have access to the Search API. Likewise, we are currently limiting the number of search results to 10,000 (with paging).

Queries can only be performed against data shipped over the prior two days (the current day and the one preceding it).

API Tokens

To use the Search API, you will first need to retrieve an API token. The token can be generated on the API Tokens page in your account’s user settings. In the UI, go to Tools | API Tokens:

Using the API

For the most updated instruction on using the API, please refer to the documentation.

Once you have your token, you can begin querying your data.

First, build your query in JSON format in a file. You can refer to the Elasticsearch Search API documentation for guidance on how to build the query.

For example, I’m going to query my account for a simple string and limit the search to one response:


   "from" : 0, "size" : 1,
    "query": {
        "query_string": {
            "query": "canada"

Then, build your API as follows (replace API-TOKEN with your token and QUERY with the path to your query file):

curl -XPOST '' --header "X-API-TOKEN: " --header "Content-Type: application/json" --data-binary @

And the response:




We’d love to get your feedback. If you encounter any bugs, please open an issue on GitHub or send us your comments to: support (at)

Happy querying!

Observability at scale, powered by open source


2022 Gartner® Magic Quadrant for Application Performance Monitoring and Observability
Forrester Observability Snapshot.

Organize Your Kubernetes Logs On One Unified SaaS Platform

Learn More