AsyncSearch
Last Updated:2025-11-14
Description
Search and analyze BLS logs
API restriction
- Only index path query is supported, and it must not be empty; other query parameters (e.g., timeout) are not supported. For struct parameters, only query, aggs, fields, sort, searchAfter, highlight, and size are currently supported
- For the syntax support of the query (query) and aggs (aggregation) parameters, refer to the list below
- Random pagination is not currently supported; therefore, the from struct parameter is not supported. Only the cursor of searchAfter can be used to get the next page
- The next-page field of searchAfter only supports the first element of the array, and only returns an array with one element (as the cursor for the next page in BLS)
- The response result does not include the total parameter or _score (relevance score). If the total number of data entries is required, it can be obtained using the ValueCountAggregation aggregation syntax
- Currently, this function returns results synchronously; asynchronous is not supported. BLS will continue the query until a timeout error occurs
The Elasticsearch search syntax currently supported by BLS is as follows:
- MatchAllQuery
- BoolQuery
- RangeQuery
- TermQuery
- MatchPhrase
- MatchQuery
- WildcardQuery
- MultiMatchQuery
- ExistQuery
- IdsQuery
- PrefixQuery
- QueryStringQuery
- SimpleQueryStringQuery
The Elasticsearch analysis syntax currently supported by BLS is as follows:
- DateHistogramAggregation
- HistogramAggregation
- TermsAggregation
- SamplerAggregation
- RandomSamplerBridgeAggregation
- ValueCountAggregation
- CardinalityAggregation
- MaxAggregation
- MinAggregation
- SumAggregation
- AverageAggregation
- PercentilesAggregation
- StatsAggregation
- FilterAggregation
- FiltersAggregation
Request
- Request syntax
POST /<name>/_async_search HTTP/1.1
Host: <Endpoint>
Authorization: <Authorization String>- Request headers
No additional headers are required beyond the standard request headers.
- Request parameters
| Parameter name | Types | Required or not | Parameter location | Description |
|---|---|---|---|---|
| name | String | Yes | Path | Index name: Fuzzy matching is not supported |
| query | Object | Yes | RequestBody | The syntax is the same as that of ordinary queryDSL; refer to the official website for syntax rules |
| aggs | Object | No | RequestBody | The syntax is the same as that of ordinary Aggregations; refer to the official website for syntax rules |
| fields | List<String> | No | RequestBody | Field list in response: All fields by default |
| sort | Map<String, Map<String, String>> | No | RequestBody | Sorting: Currently, only sorting by @timestamp is supported; sorted in descending order of time by default |
| searchAfter | List<String> | No | RequestBody | Next-page cursor: Currently, only the first element of the array is supported. Queries start from the first entry at the specified time by default |
| highlight | Highlight | No | RequestBody | Highlight configuration |
| size | Int | No | RequestBody | Number of matching logs to return: Default is 1000 |
The element structure of Highlight object is as follows:
| Parameter name | Types | Required or not | Parameter location | Description |
|---|---|---|---|---|
| pre_tags | List<String> | No | RequestBody | Prefix identifier for highlight: Default is @kibana-highlighted-field@ |
| post_tags | List<String> | No | RequestBody | Suffix identifier for highlight: Default is @/kibana-highlighted-field@ |
Successful response
- Response headers
No additional headers are required beyond the standard response headers.
- Response parameters
| Field | Types | Description |
|---|---|---|
| start_time_in_millis | Int | Query start time |
| expiration_time_in_millis | Int | Query end time |
| response | Response | Response Body |
The element structure of response object in the above table is as follows:
| Field | Types | Description |
|---|---|---|
| took | Int | Query duration |
| timed_out | Boolean | Whether timeout occurred |
| _shards | Shard | Query shard status |
| hits | Matched documents | |
| aggregations | Aggregations | Aggregation results: Refer to the official website |
The element structure of Shard object is as follows:
| Field | Types | Description |
|---|---|---|
| total | Int | Total number of shards queried: Currently fixed at 1 |
| successful | Int | Number of successful shards |
| skipped | Int | Number of skipped shards |
| failed | Int | Number of failed shards |
The element structure of Hit object is as follows:
| Field | Types | Description |
|---|---|---|
| _index | String | Project and logstore information: For non-default projects, the format is ProjectName$LogStoreName; for the default project, only the logstore name is displayed |
| _id | String | Logstore record ID: Composed of offset and timestamp |
| _score | Double | Score: Currently fixed at 0 |
| sort | List<String> | Sort field: Used to retrieve the next page; currently contains only one element |
| _version | Int | Version: Currently fixed at 1 |
| fields | Map<String, []Any> | Logstore field information |
| _version | Int | Version: Currently fixed at 1 |
Anomaly response
- Response headers
No additional headers are required beyond the standard response headers.
- Response parameters
| Field | Types | Description |
|---|---|---|
| error | Error | Error reason |
| status | Int | HTTP status code: e.g., 500 |
The element structure of Error object in the above table is as follows:
| Field | Types | Description |
|---|---|---|
| root_cause | List<Error> | Root cause |
| caused_by | Error | Specific cause |
| type | String | Error type |
| reason | String | Error reason |
Example
- Request example
POST /my-index/_async_search HTTP/1.1
Host: bls-log.bj.baidubce.com
Authorization:bce-auth-v1/18717522d39411e9b721df098b0b908c/2019-09-10T07:00:20Z/1800/content-type;host;x-bce-date;x-bce-request-id/6a7cb6c9ac7ec156c805e55e7d0bcfc443b47feee97cf099c1c0d93a0b4c8304
Content-Type: application/json; charset=utf-8
{
// Required: Elasticsearch query syntax. Refer to the description below for supported syntax
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2025-08-01T04:18:44.642Z",
"lte": "2025-08-01T06:18:44.642Z"
}
}
}
]
}
},
// Optional: Elasticsearch aggregation syntax. Refer to the description below for supported syntax
"aggs": {
"0": {
"terms": {
"field": "level",
"order": {
"_count": "desc"
},
"size": 3
},
"aggs": {
"1": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "30m",
}
}
}
}
},
// Field list in response: All fields by default
"fields": [
{
"field": "*",
"include_unmapped": "true"
}
],
// Optional: Sorting: Currently, only sorting by timestamp is supported; sorted in descending order of time by default
"sort": [
{
"timestamp": {
"order": "desc",
}
}
],
// Optional: Next-page cursor: Currently, only the first element of the array is supported. Queries start from the first entry at the specified time by default
"searchAfter": [
"CJPphaWXMxCMgNz4haWXMxj0Aw"
]
// Highlight configuration: Optional
"highlight": {
// Optional: Prefix identifier for highlight: Default is @kibana-highlighted-field@
"pre_tags": [
"@kibana-highlighted-field@"
],
// Optional: Suffix identifier for highlight: Default is @/kibana-highlighted-field@
"post_tags": [
"@/kibana-highlighted-field@"
]
}
// Optional: Number of matching logs to return: Default is 1000
"size": 20
}- Response example
HTTP/1.1 204
Content-Type: application/json; charset=utf-8
X-Bce-Request-Id: 2eeba101-4cc7-4cfe-b5ac-a3be8d060e33
Date: Fri, 10 Apr 2020 04:42:37 GMT
// Success example
{
// Query start time
"start_time_in_millis": 1696324475123,
// Query end time
"expiration_time_in_millis": 1696929275123,
// Response body
"response": {
// Query duration
"took": 132,
// Whether timeout occurred
"timed_out": false,
// Query shard status
"_shards": {
// Total number of shards queried: Currently fixed at 1
"total": 1,
// Number of successful shards
"successful": 1,
// Number of skipped shards
"skipped": 0,
// Number of failed shards
"failed": 0
},
// Query match results
"hits": {
// Specific log record information: One element represents one log record
"hits": [
{
// Project and logstore information: For non-default projects, the format is ProjectName$LogStoreName; for the default project, only the logstore name is displayed
"_index": "project$logstore",
// Logstore record ID: Composed of offset and timestamp
"_id": "1758596174317#28812839737868314",
// Score: Currently fixed at 0
"_score": 0,
// Sort field: Used to retrieve the next page
"sort": [
"CJPphaWXMxCMgNz4haWXMxj0Aw"
],
// Version: Currently fixed at 1
"_version": 1
// Logstore field information
"fields": {
// Time field
"@timestamp": [
"2025-09-23T03:32:48.750Z"
],
// Index field caller
"caller": [
"middleware/log_request.go:47"
],
// Index field ip
"ip": [
"10.164.105.42"
],
}
}
]
},
// Log aggregation information
"aggregations": {
// First bucket aggregation information
"0": {
"buckets": [
{
// Second bucket aggregation information
"1": {
"buckets": [
{
// Total number of logs in this bucket
"doc_count": 66626,
// Name of the first bucket
"key": 1758508200000,
// String information
"key_as_string": "2025-09-22T02:30:00.000+00:00"
},
{
"doc_count": 189923,
"key": 1758510000000,
"key_as_string": "2025-09-22T03:00:00.000+00:00"
},
]
},
// Number of matching logs in the second bucket
"doc_count": 9185770,
// Name of the second bucket
"key": "info"
},
{
"1": {
"buckets": [
{
"doc_count": 31945,
"key": 1758508200000,
"key_as_string": "2025-09-22T02:30:00.000+00:00"
},
{
"doc_count": 84637,
"key": 1758510000000,
"key_as_string": "2025-09-22T03:00:00.000+00:00"
}
]
},
"doc_count": 4093518,
"key": "warn"
}
],
// Number of error documents
"doc_count_error_upper_bound": 0,
// Number of other documents
"sum_other_doc_count": 565
}
}
}
}
// Exception example
{
"error": {
"root_cause": [
{
"type": "status_exception",
"reason": "exist stat aggregations syntax not support",
}
],
"caused_by": {
"type": "search_phase_execution_exception",
"reason": "all shards failed"
"caused_by": {
"type": "parse_exception",
"reason": "exist stat aggregations syntax not support"
}
}
"type": "status_exception",
"reason": "error while executing search"
},
"status": 500
}