Fix eql.search response types

elastic · Jul 1, 2024 · ae8fe8e · ae8fe8e
1 parent 3f5c846
commit ae8fe8e
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/specification/_doc_ids/table.csv b/specification/_doc_ids/table.csv
@@ -143,6 +143,7 @@ eql-async-search-status-api,https://www.elastic.co/guide/en/elasticsearch/refere
 eql-basic-syntax,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql-syntax.html#eql-basic-syntax
 eql-search-api,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql-search-api.html
 eql-sequences,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql-syntax.html#eql-sequences
+eql-missing-events,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql-syntax.html#eql-missing-events
 eql-syntax,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql-syntax.html
 eql,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/eql.html
 esql-query,https://www.elastic.co/guide/en/elasticsearch/reference/{branch}/esql-rest.html

diff --git a/specification/eql/_types/EqlHits.ts b/specification/eql/_types/EqlHits.ts
@@ -45,6 +45,11 @@ export class HitsEvent<TEvent> {
   _id: Id
   /** Original JSON body passed for the event at index time. */
   _source: TEvent
+  /**
+  * Set to `true` for events in a timespan-constrained sequence that do not meet a given condition.
+  * @doc_id eql-missing-events
+  */
+  missing?: boolean
   fields?: Dictionary<Field, UserDefinedValue[]>
 }
 
@@ -55,5 +60,5 @@ export class HitsSequence<TEvent> {
    * Shared field values used to constrain matches in the sequence. These are defined using the by keyword in the EQL query syntax.
    * @doc_id eql-sequences
    */
-  join_keys: UserDefinedValue[]
+  join_keys?: UserDefinedValue[]
 }