Skip to content

Make EQL REST Querying API async #49638

@colings86

Description

@colings86

Once we have the EQL REST Endpoint created from #49634 we should explore making the API asynchronous.

Since EQL queries will require multiple underlying search requests and may need to search through lots of data the queries could take a long time to execute. To give a better user experience it would be good if the query can be executed asynchronously with the user able to request progress and retrieve the final results when they are available.

We already have development underway on adding an asynchronous search API (#49091) so the user experience we add here should be as similar to that as practical so we have consistency in the approaches. The reason we can't just piggyback on the async search API is that the EQL plugin will need to run extra logic on top of the search API, which will require it to have its own async mechanism.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions