Package co.elastic.clients.elasticsearch.eql

Class EqlSearchRequest.Builder

java.lang.Object

co.elastic.clients.util.ObjectBuilderBase

co.elastic.clients.util.WithJsonObjectBuilderBase<BuilderT>

co.elastic.clients.elasticsearch._types.RequestBase.AbstractBuilder<EqlSearchRequest.Builder>

co.elastic.clients.elasticsearch.eql.EqlSearchRequest.Builder

All Implemented Interfaces:

WithJson<EqlSearchRequest.Builder>, ObjectBuilder<EqlSearchRequest>

Enclosing class:

EqlSearchRequest

public static class EqlSearchRequest.Builder
extends RequestBase.AbstractBuilder<EqlSearchRequest.Builder>
implements ObjectBuilder<EqlSearchRequest>

Builder for EqlSearchRequest.

Constructor Summary

Constructors

Constructor	Description
Builder()

Method Summary

Modifier and Type	Method	Description
final EqlSearchRequest.Builder	allowNoIndices(Boolean value)	API name: allow_no_indices
EqlSearchRequest	build()	Builds a EqlSearchRequest.
final EqlSearchRequest.Builder	caseSensitive(Boolean value)	API name: case_sensitive
final EqlSearchRequest.Builder	eventCategoryField(String value)	Field containing the event classification, such as process, file, or network.
final EqlSearchRequest.Builder	expandWildcards(ExpandWildcard value, ExpandWildcard... values)	API name: expand_wildcards
final EqlSearchRequest.Builder	expandWildcards(List<ExpandWildcard> list)	API name: expand_wildcards
final EqlSearchRequest.Builder	fetchSize(Number value)	Maximum number of events to search at a time for sequence queries.
final EqlSearchRequest.Builder	fields(FieldAndFormat value)	Array of wildcard (*) patterns.
final EqlSearchRequest.Builder	fields(Function<FieldAndFormat.Builder,ObjectBuilder<FieldAndFormat>> fn)	Array of wildcard (*) patterns.
final EqlSearchRequest.Builder	filter(Query value, Query... values)	Query, written in Query DSL, used to filter the events on which the EQL query runs.
final EqlSearchRequest.Builder	filter(Function<Query.Builder,ObjectBuilder<Query>> fn)	Query, written in Query DSL, used to filter the events on which the EQL query runs.
final EqlSearchRequest.Builder	filter(List<Query> list)	Query, written in Query DSL, used to filter the events on which the EQL query runs.
final EqlSearchRequest.Builder	ignoreUnavailable(Boolean value)	If true, missing or closed indices are not included in the response.
final EqlSearchRequest.Builder	index(String value)	Required - The name of the index to scope the operation
final EqlSearchRequest.Builder	keepAlive(Time value)	API name: keep_alive
final EqlSearchRequest.Builder	keepAlive(Function<Time.Builder,ObjectBuilder<Time>> fn)	API name: keep_alive
final EqlSearchRequest.Builder	keepOnCompletion(Boolean value)	API name: keep_on_completion
final EqlSearchRequest.Builder	query(String value)	Required - EQL query you wish to run.
final EqlSearchRequest.Builder	resultPosition(ResultPosition value)	API name: result_position
protected EqlSearchRequest.Builder	self()
final EqlSearchRequest.Builder	size(Number value)	For basic queries, the maximum number of matching events to return.
final EqlSearchRequest.Builder	tiebreakerField(String value)	Field used to sort hits with the same timestamp in ascending order
final EqlSearchRequest.Builder	timestampField(String value)	Field containing event timestamp.
final EqlSearchRequest.Builder	waitForCompletionTimeout(Time value)	API name: wait_for_completion_timeout
final EqlSearchRequest.Builder	waitForCompletionTimeout(Function<Time.Builder,ObjectBuilder<Time>> fn)	API name: wait_for_completion_timeout

Methods inherited from class co.elastic.clients.util.WithJsonObjectBuilderBase

withJson

Methods inherited from class co.elastic.clients.util.ObjectBuilderBase

_checkSingleUse, _listAdd, _listAddAll, _mapPut, _mapPutAll

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface co.elastic.clients.json.WithJson

withJson, withJson

Constructor Details

Builder

public Builder()

Method Details

allowNoIndices

public final EqlSearchRequest.Builder allowNoIndices(@Nullable
 Boolean value)

API name: allow_no_indices

caseSensitive

public final EqlSearchRequest.Builder caseSensitive(@Nullable
 Boolean value)

API name: case_sensitive

eventCategoryField

public final EqlSearchRequest.Builder eventCategoryField(@Nullable
 String value)

Field containing the event classification, such as process, file, or network.

API name: event_category_field

expandWildcards

public final EqlSearchRequest.Builder expandWildcards(List<ExpandWildcard> list)

API name: expand_wildcards

Adds all elements of list to expandWildcards.

expandWildcards

public final EqlSearchRequest.Builder expandWildcards(ExpandWildcard value,
 ExpandWildcard... values)

API name: expand_wildcards

Adds one or more values to expandWildcards.

fetchSize

public final EqlSearchRequest.Builder fetchSize(@Nullable
 Number value)

Maximum number of events to search at a time for sequence queries.

API name: fetch_size

fields

public final EqlSearchRequest.Builder fields(@Nullable
 FieldAndFormat value)

Array of wildcard (*) patterns. The response returns values for field names matching these patterns in the fields property of each hit.

API name: fields

fields

public final EqlSearchRequest.Builder fields(Function<FieldAndFormat.Builder,ObjectBuilder<FieldAndFormat>> fn)

Array of wildcard (*) patterns. The response returns values for field names matching these patterns in the fields property of each hit.

API name: fields

filter

public final EqlSearchRequest.Builder filter(List<Query> list)

Query, written in Query DSL, used to filter the events on which the EQL query runs.

API name: filter

Adds all elements of list to filter.

filter

public final EqlSearchRequest.Builder filter(Query value,
 Query... values)

Query, written in Query DSL, used to filter the events on which the EQL query runs.

API name: filter

Adds one or more values to filter.

filter

public final EqlSearchRequest.Builder filter(Function<Query.Builder,ObjectBuilder<Query>> fn)

Query, written in Query DSL, used to filter the events on which the EQL query runs.

API name: filter

Adds a value to filter using a builder lambda.

ignoreUnavailable

public final EqlSearchRequest.Builder ignoreUnavailable(@Nullable
 Boolean value)

If true, missing or closed indices are not included in the response.

API name: ignore_unavailable

index

public final EqlSearchRequest.Builder index(String value)

Required - The name of the index to scope the operation

API name: index

keepAlive

public final EqlSearchRequest.Builder keepAlive(@Nullable
 Time value)

API name: keep_alive

keepAlive

public final EqlSearchRequest.Builder keepAlive(Function<Time.Builder,ObjectBuilder<Time>> fn)

API name: keep_alive

keepOnCompletion

public final EqlSearchRequest.Builder keepOnCompletion(@Nullable
 Boolean value)

API name: keep_on_completion

query

public final EqlSearchRequest.Builder query(String value)

Required - EQL query you wish to run.

API name: query

resultPosition

public final EqlSearchRequest.Builder resultPosition(@Nullable
 ResultPosition value)

API name: result_position

size

public final EqlSearchRequest.Builder size(@Nullable
 Number value)

For basic queries, the maximum number of matching events to return. Defaults to 10

API name: size

tiebreakerField

public final EqlSearchRequest.Builder tiebreakerField(@Nullable
 String value)

Field used to sort hits with the same timestamp in ascending order

API name: tiebreaker_field

timestampField

public final EqlSearchRequest.Builder timestampField(@Nullable
 String value)

Field containing event timestamp. Default "@timestamp"

API name: timestamp_field

waitForCompletionTimeout

public final EqlSearchRequest.Builder waitForCompletionTimeout(@Nullable
 Time value)

API name: wait_for_completion_timeout

waitForCompletionTimeout

public final EqlSearchRequest.Builder waitForCompletionTimeout(Function<Time.Builder,ObjectBuilder<Time>> fn)

API name: wait_for_completion_timeout

self

protected EqlSearchRequest.Builder self()

Specified by:

self in class RequestBase.AbstractBuilder<EqlSearchRequest.Builder>

build

public EqlSearchRequest build()

Builds a EqlSearchRequest.

Specified by:

build in interface ObjectBuilder<EqlSearchRequest>

Throws:

NullPointerException - if some of the required fields are null.