Live Search Request

A live search request is similar to the simple search request. The difference is that a live search request does not complete. Instead, the search returns all the matching records to the client, and then keeps the HTTP request open. As new data is ingested into the repository, matching results are immediately sent to the client.

Important

Live searches can be terminated at any time, and do not work with aggregate functions and operators. For more information on the operation of Live Queries, see Live Search Operation. This may mean that a live query fails, or 'times out' during execution and results may fail to be returned without a clear indication of the reason. Using the Query Job API may lead to a more reliable and reproducible result set. For more information, see Running Query Jobs.

To execute a live search request, add the isLive parameter to the request object with the value true. For example:

Show:
json
{
   "isLive" : true,
   "queryString" : "css"
}

The results match the filter will be returned instantly, but the HTTP connection will not be closed. Any additional results will be returned as they are ingested:

accesslog
192.168.1.18 - - [09/Mar/2023:17:06:04 +0000] "GET /css-images/book-open.svg HTTP/1.1" 200 339
192.168.1.18 - - [09/Mar/2023:17:06:04 +0000] "GET /css-images/logo-white.svg HTTP/1.1" 200 2275
192.168.1.18 - - [09/Mar/2023:17:06:04 +0000] "GET /css-images/slack.svg HTTP/1.1" 200 999
127.0.0.1 - - [10/Mar/2023:09:43:42 +0000] "GET /theme-home.css HTTP/1.1" 200 70699
...
192.168.1.18 - - [11/Mar/2023:17:06:04 +0000] "GET /css-images/slack.svg HTTP/1.1" 200 999