-
Notifications
You must be signed in to change notification settings - Fork 25.6k
Description
Once we have the EQL REST Endpoint created from #49634 we should explore making the API asynchronous.
Since EQL queries will require multiple underlying search requests and may need to search through lots of data the queries could take a long time to execute. To give a better user experience it would be good if the query can be executed asynchronously with the user able to request progress and retrieve the final results when they are available.
We already have development underway on adding an asynchronous search API (#49091) so the user experience we add here should be as similar to that as practical so we have consistency in the approaches. The reason we can't just piggyback on the async search API is that the EQL plugin will need to run extra logic on top of the search API, which will require it to have its own async mechanism.