|
@@ -57,12 +57,9 @@ See <<eql-syntax-limitations,EQL limitations>>.
|
|
|
==== {api-path-parms-title}
|
|
|
|
|
|
`<target>`::
|
|
|
-(Required, string)
|
|
|
-Comma-separated list of data streams, indices, or <<indices-aliases,index
|
|
|
-aliases>> used to limit the request. Accepts wildcard (`*`) expressions.
|
|
|
-+
|
|
|
-To search all data streams and indices in a cluster, use
|
|
|
-`_all` or `*`.
|
|
|
+(Required, string) Comma-separated list of data streams, indices, or aliases
|
|
|
+used to limit the request. Supports wildcards (`*`). To search all data streams
|
|
|
+and indices, use `*` or `_all`.
|
|
|
|
|
|
[[eql-search-api-query-params]]
|
|
|
==== {api-query-parms-title}
|
|
@@ -73,11 +70,11 @@ To search all data streams and indices in a cluster, use
|
|
|
NOTE: This parameter's behavior differs from the `allow_no_indices` parameter
|
|
|
used in other <<multi-index,multi-target APIs>>.
|
|
|
+
|
|
|
-If `false`, the request returns an error if any wildcard expression,
|
|
|
-<<indices-aliases,index alias>>, or `_all` value targets only missing or closed
|
|
|
-indices. This behavior applies even if the request targets other open indices.
|
|
|
-For example, a request targeting `foo*,bar*` returns an error if an index
|
|
|
-starts with `foo` but no index starts with `bar`.
|
|
|
+If `false`, the request returns an error if any wildcard pattern, alias, or
|
|
|
+`_all` value targets only missing or closed indices. This behavior applies even
|
|
|
+if the request targets other open indices. For example, a request targeting
|
|
|
+`foo*,bar*` returns an error if an index starts with `foo` but no index starts
|
|
|
+with `bar`.
|
|
|
+
|
|
|
If `true`, only requests that exclusively target missing or closed indices
|
|
|
return an error. For example, a request targeting `foo*,bar*` does not return an
|