Skip to content

[REQUEST]: EQL event queries allow for partial results #610

@dhurley14

Description

@dhurley14

Description

What: EQL event queries will now return partial results if a given shard that otherwise would have been part of the query results is not available. Previously an error would be returned with no hits. Now we can return a list of hits from the available shards and an error message explaining how we allow for partial results. See this PR for more details elastic/kibana#207396
When: This is available in 8.18 and 9.0.
Why: It is now supported by Elasticsearch: elastic/elasticsearch#116388

Resources

This feature was implemented in elastic/kibana#207396

Which documentation set does this change impact?

Elastic On-Prem and Cloud (all)

Feature differences

This feature is identical in all deployments

What release is this request related to?

8.18

Collaboration model

The documentation team

Point of contact.

Main contact: @dhurley14 @yctercero

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions