Repository: demisto/content
Pull request #40112: Elasticsearch v.1.3.33 ES|QL Support
Author: login: mohlcyber
Labels: name: Contribution
description: Thank you! Contributions are always welcome!
name: docs-approved
name: post-demo
name: Contribution Form Filled
description: Whether contribution form filled or not.
name: Community
name: Xsoar Support Level
description: Indicates that the contribution is for XSOAR supported pack
name: External PR
Created: 2025-05-27T11:10:43Z | Merged: 2025-05-28T06:04:30Z

## Status
- [ ] In Progress
- [x] Ready
- [ ] In Hold - (Reason for hold)

## Description
Added the es-esql-search command to run ES|QL Queries.

## Must have
- [X] Tests
- [X] Documentation 



Diff:
diff --git a/Packs/Elasticsearch/CONTRIBUTORS.json b/Packs/Elasticsearch/CONTRIBUTORS.json
index e98e15c3e0f9..8b9752a39802 100644
--- a/Packs/Elasticsearch/CONTRIBUTORS.json
+++ b/Packs/Elasticsearch/CONTRIBUTORS.json
@@ -1 +1,4 @@
-["Joel Cuter"]
\ No newline at end of file
+[
+    "Joel Cuter",
+    "Martin Ohl"
+]
\ No newline at end of file
diff --git a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.py b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.py
index 84280b10efd1..77012bfb9cde 100644
--- a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.py
+++ b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.py
@@ -19,6 +19,7 @@
 warnings.filterwarnings(action="ignore", message=".*using SSL with verify_certs=False is insecure.")
 
 ELASTICSEARCH_V8 = "Elasticsearch_v8"
+ELASTICSEARCH_V9 = "Elasticsearch_v9"
 OPEN_SEARCH = "OpenSearch"
 ELASTIC_SEARCH_CLIENT = demisto.params().get("client_type")
 if ELASTIC_SEARCH_CLIENT == OPEN_SEARCH:
@@ -26,9 +27,9 @@
     from opensearch_dsl.query import QueryString
     from opensearchpy import NotFoundError, RequestsHttpConnection
     from opensearchpy import OpenSearch as Elasticsearch
-elif ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
+elif ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, ELASTICSEARCH_V9]:
     from elastic_transport import RequestsHttpNode
-    from elasticsearch import Elasticsearch, NotFoundError  # type: ignore[assignment,misc]
+    from elasticsearch import Elasticsearch, NotFoundError  # type: ignore[assignment]
     from elasticsearch_dsl import Search
     from elasticsearch_dsl.query import QueryString
 else:  # Elasticsearch (<= v7)
@@ -166,7 +167,7 @@ def elasticsearch_builder(proxies):
         "timeout": TIMEOUT,
     }
     demisto.debug(f"Building Elasticsearch client with args: {connection_args}")
-    if ELASTIC_SEARCH_CLIENT != ELASTICSEARCH_V8:
+    if ELASTIC_SEARCH_CLIENT not in [ELASTICSEARCH_V9, ELASTICSEARCH_V8]:
         # Adding the proxy related parameters to the Elasticsearch client v7 and below or OpenSearch (BC)
         connection_args["connection_class"] = RequestsHttpConnection  # type: ignore[assignment]
         connection_args["proxies"] = proxies
@@ -185,7 +186,7 @@ def __init__(self, *args, **kwargs):
         connection_args["api_key"] = API_KEY
 
     elif USERNAME:
-        if ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
+        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8]:
             connection_args["basic_auth"] = (USERNAME, PASSWORD)
         else:  # Elasticsearch version v7 and below or OpenSearch (BC)
             connection_args["http_auth"] = (USERNAME, PASSWORD)
@@ -353,7 +354,7 @@ def search_command(proxies):
         if sort_field is not None:
             search = search.sort({sort_field: {"order": sort_order}})
 
-        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
             response = search.execute().to_dict()
 
         else:  # Elasticsearch v7 and below
@@ -406,7 +407,7 @@ def test_query_to_fetch_incident_index(es):
         query = QueryString(query="*")
         search = Search(using=es, index=FETCH_INDEX).query(query)[0:1]
 
-        if ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
+        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8]:
             response = search.execute().to_dict()
 
         else:  # Elasticsearch v7 and below or OpenSearch
@@ -430,7 +431,7 @@ def test_general_query(es):
         query = QueryString(query="*")
         search = Search(using=es, index="*").query(query)[0:1]
 
-        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
             response = search.execute().to_dict()
 
         else:  # Elasticsearch v7 and below
@@ -462,7 +463,7 @@ def test_time_field_query(es):
     query = QueryString(query=TIME_FIELD + ":*")
     search = Search(using=es, index=FETCH_INDEX).query(query)[0:1]
 
-    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
         response = search.execute().to_dict()
 
     else:  # Elasticsearch v7 and below
@@ -495,7 +496,7 @@ def test_fetch_query(es):
     query = QueryString(query=str(TIME_FIELD) + ":* AND " + FETCH_QUERY)
     search = Search(using=es, index=FETCH_INDEX).query(query)[0:1]
 
-    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
         response = search.execute().to_dict()
 
     else:  # Elasticsearch v7 and below
@@ -576,10 +577,10 @@ def verify_es_server_version(res):
     if es_server_version:
         major_version = es_server_version.split(".")[0]
         if major_version:
-            if int(major_version) >= 8 and ELASTIC_SEARCH_CLIENT not in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+            if int(major_version) >= 8 and ELASTIC_SEARCH_CLIENT not in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
                 raise ValueError(
                     f"Configuration Error: Your Elasticsearch server is version {es_server_version}. "
-                    f"Please ensure that the client type is set to {ELASTICSEARCH_V8} or {OPEN_SEARCH}. "
+                    f"Please ensure that the client type is set to {ELASTICSEARCH_V9}, {ELASTICSEARCH_V8} or {OPEN_SEARCH}. "
                     f"For more information please see the integration documentation."
                 )
             elif int(major_version) <= 7 and ELASTIC_SEARCH_CLIENT not in [OPEN_SEARCH, "Elasticsearch"]:
@@ -875,7 +876,7 @@ def execute_raw_query(es, raw_query, index=None, size=None, page=None):
 
     search = Search(using=es, index=requested_index).update_from_dict(body)
 
-    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
         response = search.execute().to_dict()
     else:  # Elasticsearch v7 and below
         # maintain BC by using the ES client directly (avoid using the elasticsearch_dsl library here)
@@ -900,7 +901,7 @@ def fetch_incidents(proxies):
         search = Search(using=es, index=FETCH_INDEX).filter(time_range_dict)
         search = search.sort({TIME_FIELD: {"order": "asc"}})[0:FETCH_SIZE].query(query)
 
-        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, OPEN_SEARCH]:
+        if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8, OPEN_SEARCH]:
             response = search.execute().to_dict()
 
         else:  # Elasticsearch v7 and below
@@ -1036,6 +1037,54 @@ def search_eql_command(args, proxies):
     return CommandResults(readable_output=total_human_readable, outputs_prefix="Elasticsearch.Search", outputs=search_context)
 
 
+def search_esql_command(args, proxies):
+    query = args.get("query")
+    limit = args.get("limit")
+
+    es = elasticsearch_builder(proxies)
+
+    if limit:
+        query = {"query": query + f"| LIMIT {limit}"}
+    else:
+        query = {"query": query}
+
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V8, ELASTICSEARCH_V9]:
+        compatible_with = 8 if ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8 else 9
+        headers = {
+            "Content-Type": f"application/vnd.elasticsearch+json; compatible-with={compatible_with}",
+            "Accept": f"application/vnd.elasticsearch+json; compatible-with={compatible_with}",
+        }
+    else:
+        return_error("ES|QL Search is only supported in Elasticsearch 8.11 and above.")
+        return None
+
+    demisto.debug(f"ES|QL search body: {query}")
+    res = es.perform_request(method="POST", path="/_query?format=json", headers=headers, body=query)
+
+    human_output_columns = [col["name"] for col in res["columns"]]
+    human_output_rows = res["values"]
+    human_output = []
+
+    for row in human_output_rows:
+        row_dict = {}
+        for i in range(len(human_output_columns)):
+            row_dict[human_output_columns[i]] = row[i]
+        human_output.append(row_dict)
+
+    search_human_readable = tableToMarkdown(
+        "Search query:", [{"Query": query.get("query"), "Total": str(len(human_output_rows))}], removeNull=True
+    )
+    hits_human_readable = tableToMarkdown("Results:", human_output, removeNull=True)
+    total_human_readable = search_human_readable + "\n" + hits_human_readable
+
+    return CommandResults(
+        readable_output=total_human_readable,
+        outputs_prefix="Elasticsearch.ESQLSearch",
+        outputs=human_output,
+        raw_response=res.body
+    )
+
+
 def index_document(args, proxies):
     """
     Indexes a given document into an Elasticsearch index.
@@ -1047,7 +1096,7 @@ def index_document(args, proxies):
     es = elasticsearch_builder(proxies)
 
     demisto.debug(f"Indexing document in index {index} with ID {doc_id}")
-    if ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8]:
         if doc_id:
             response = es.index(index=index, id=doc_id, document=doc)  # pylint: disable=E1123,E1120
         else:
@@ -1081,7 +1130,7 @@ def index_document_command(args, proxies):
     headers = [str(k) for k in human_readable]
     readable_output = tableToMarkdown(name="Indexed document", t=human_readable, removeNull=True, headers=headers)
 
-    if ELASTIC_SEARCH_CLIENT == ELASTICSEARCH_V8:
+    if ELASTIC_SEARCH_CLIENT in [ELASTICSEARCH_V9, ELASTICSEARCH_V8]:
         resp = resp.body
 
     result = CommandResults(
@@ -1168,6 +1217,8 @@ def main():  # pragma: no cover
             return_results(get_mapping_fields_command())
         elif demisto.command() == "es-eql-search":
             return_results(search_eql_command(args, proxies))
+        elif demisto.command() == "es-esql-search":
+            return_results(search_esql_command(args, proxies))
         elif demisto.command() == "es-index":
             return_results(index_document_command(args, proxies))
         elif demisto.command() == "es-integration-health-check":
diff --git a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
index b8cf5f3cc249..9b9d2cc66353 100644
--- a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
+++ b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
@@ -38,6 +38,7 @@ configuration:
   - Elasticsearch
   - OpenSearch
   - Elasticsearch_v8
+  - Elasticsearch_v9
   type: 15
   section: Connect
   advanced: true
@@ -424,6 +425,17 @@ script:
       description: The result of the index operation.
       type: string
     description: Indexes a document into an Elasticsearch index.
+  - name: es-esql-search
+    arguments:
+      - description: The ES|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value").
+        name: query
+        required: true
+      - description: Maximum number of results to return.
+        name: limit
+    description: Search using ES|QL query. (Elastic >=8.11).
+    outputs:
+      - contextPath: Elasticsearch.ESQLSearch
+        description: ES|QL search result.
   dockerimage: demisto/elasticsearch:1.0.0.2640600
   isfetch: true
   runonce: false
diff --git a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2_test.py b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2_test.py
index ee4dd9677539..a4bae46d3020 100644
--- a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2_test.py
+++ b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2_test.py
@@ -91,6 +91,13 @@
     },
 }
 
+ES_V9_RESPONSE = {
+    "took": 11,
+    "is_partial": False,
+    "columns": [{"name": "alertDetails.alertuser", "type": "text"}],
+    "values": [["karl@test.io"]],
+}
+
 MOCK_ES7_SEARCH_CONTEXT = str(
     {
         "Server": "",
@@ -1137,3 +1144,26 @@ def test_verify_es_server_version_errors(mocker, server_details, server_version,
     with pytest.raises(ValueError) as e:
         Elasticsearch_v2.verify_es_server_version(server_details)
     assert server_version in str(e.value)
+
+
+def test_search_command_with_query_esql(mocker):
+    """
+    Given
+      - query to the search command with esql
+
+    When
+    - executing the es-esql-search command
+
+    Then
+     - Make sure that the expected message is returned.
+    """
+    import Elasticsearch_v2
+
+    args = {"query": """FROM alerts | WHERE alertDetails.alertuser LIKE "*karl*"| KEEP *"""}
+
+    with patch.object(Elasticsearch_v2, "search_esql_command", return_value=ES_V9_RESPONSE) as mock_search:
+        result = Elasticsearch_v2.search_esql_command(args, {})
+        assert result["took"] == 11
+        assert result["values"][0] == ["karl@test.io"]
+        assert result["columns"][0]["type"] == "text"
+        mock_search.assert_called_once_with(args, {})
diff --git a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
index 58f361b43e6a..433ba57801cd 100644
--- a/Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
+++ b/Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
@@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query (Elasticsearch 8.11 and above).
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description**                                                                | **Required** |
+| --- |--------------------------------------------------------------------------------| --- |
+| query | The ES\|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value"). | Required | 
+| limit | Maximum number of results to return.                                           | Optional | 
+
+#### Context Output
+
+| **Path**                 | **Description**      | **Type** |
+|--------------------------|----------------------|----------------------|
+| Elasticsearch.ESQLSearch | ES\|QL search result | unknown |
\ No newline at end of file
diff --git a/Packs/Elasticsearch/ReleaseNotes/1_3_33.md b/Packs/Elasticsearch/ReleaseNotes/1_3_33.md
new file mode 100644
index 000000000000..c203268a38c6
--- /dev/null
+++ b/Packs/Elasticsearch/ReleaseNotes/1_3_33.md
@@ -0,0 +1,5 @@
+
+#### Integrations
+
+##### Elasticsearch v2
+Added the es-esql-search command to run ES|QL queries.
diff --git a/Packs/Elasticsearch/pack_metadata.json b/Packs/Elasticsearch/pack_metadata.json
index 252eaf552622..49b0e2a57674 100644
--- a/Packs/Elasticsearch/pack_metadata.json
+++ b/Packs/Elasticsearch/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Elasticsearch",
     "description": "Search for and analyze data in real time. \n Supports version 6 and later.",
     "support": "xsoar",
-    "currentVersion": "1.3.32",
+    "currentVersion": "1.3.33",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",


Reviews:
user: login: ilappe
body: Great work @mohlcyber 
thank you!
will waiting for doc review completion
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T12:20:53Z
user: login: julieschwartz18
body: Doc review complete. @mohlcyber Please confirm the edits.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T13:18:57Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:49:12Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:49:57Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:50:43Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:51:46Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:52:51Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:54:45Z
user: login: mohlcyber
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-27T20:55:36Z

Review comments:
diff_hunk: @@ -424,6 +425,17 @@ script:
       description: The result of the index operation.
       type: string
     description: Indexes a document into an Elasticsearch index.
+  - name: es-esql-search
+    arguments:
+      - description: The ES|QL query string to execute using piped syntax (e.g., FROM index | WHERE field == "value").
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
user: login: julieschwartz18
body: The ES|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value").
created_at: 2025-05-27T13:11:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -424,6 +425,17 @@ script:
       description: The result of the index operation.
       type: string
     description: Indexes a document into an Elasticsearch index.
+  - name: es-esql-search
+    arguments:
+      - description: The ES|QL query string to execute using piped syntax (e.g., FROM index | WHERE field == "value").
+        name: query
+        required: true
+      - description: Maximum number of results to return.
+        name: limit
+    description: Search using ES|QL query. (Elastic >=8.11).
+    outputs:
+      - contextPath: Elasticsearch.ESQLSearch
+        description: ES|QL Search Result.
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
user: login: julieschwartz18
body: ES|QL search result.
created_at: 2025-05-27T13:12:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,5 @@
+
+#### Integrations
+
+##### Elasticsearch v2
+Added the es-esql-search command to run ES|QL Queries.
path: Packs/Elasticsearch/ReleaseNotes/1_3_33.md
user: login: julieschwartz18
body: Added the ***es-esql-search*** command to run ES|QL queries.
created_at: 2025-05-27T13:13:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: julieschwartz18
body: The ES|QL query string to execute using piped syntax (for example, FROM index | WHERE field == "value").
created_at: 2025-05-27T13:14:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
+| limit | Maximum number of results to return. | Optional | 
+
+#### Context Output
+
+| **Path**                 | **Type** | **Description**      |
+|--------------------------| --- |----------------------|
+| Elasticsearch.ESQLSearch | unknown | ES\|QL Search Result | 
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: julieschwartz18
body: Elasticsearch.ESQLSearch | ES|QL Search Result | unknown | 
created_at: 2025-05-27T13:16:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
+| limit | Maximum number of results to return. | Optional | 
+
+#### Context Output
+
+| **Path**                 | **Type** | **Description**      |
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: julieschwartz18
body: | **Path**                 | **Description** | **Type**      |
created_at: 2025-05-27T13:16:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: julieschwartz18
body: Search using ES|QL query (Elasticsearch 8.11 and above).
created_at: 2025-05-27T13:18:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -424,6 +425,17 @@ script:
       description: The result of the index operation.
       type: string
     description: Indexes a document into an Elasticsearch index.
+  - name: es-esql-search
+    arguments:
+      - description: The ES|QL query string to execute using piped syntax (e.g., FROM index | WHERE field == "value").
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
user: login: mohlcyber
body: Thanks for the review. Changes committed.
created_at: 2025-05-27T20:49:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -424,6 +425,17 @@ script:
       description: The result of the index operation.
       type: string
     description: Indexes a document into an Elasticsearch index.
+  - name: es-esql-search
+    arguments:
+      - description: The ES|QL query string to execute using piped syntax (e.g., FROM index | WHERE field == "value").
+        name: query
+        required: true
+      - description: Maximum number of results to return.
+        name: limit
+    description: Search using ES|QL query. (Elastic >=8.11).
+    outputs:
+      - contextPath: Elasticsearch.ESQLSearch
+        description: ES|QL Search Result.
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/Elasticsearch_v2.yml
user: login: mohlcyber
body: Thanks for the review. Done.
created_at: 2025-05-27T20:49:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,5 @@
+
+#### Integrations
+
+##### Elasticsearch v2
+Added the es-esql-search command to run ES|QL Queries.
path: Packs/Elasticsearch/ReleaseNotes/1_3_33.md
user: login: mohlcyber
body: Thanks for the review. Done.
created_at: 2025-05-27T20:50:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: mohlcyber
body: Thanks for the review. Done
created_at: 2025-05-27T20:51:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
+| limit | Maximum number of results to return. | Optional | 
+
+#### Context Output
+
+| **Path**                 | **Type** | **Description**      |
+|--------------------------| --- |----------------------|
+| Elasticsearch.ESQLSearch | unknown | ES\|QL Search Result | 
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: mohlcyber
body: Backslash required in MD to escape pipe. Order adjusted. Thanks for the review.
created_at: 2025-05-27T20:52:50Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
+
+#### Base Command
+
+`es-esql-search`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| query | The ES\|QL query string to execute using piped syntax (e.g., FROM index \| WHERE field == "value"). | Required | 
+| limit | Maximum number of results to return. | Optional | 
+
+#### Context Output
+
+| **Path**                 | **Type** | **Description**      |
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: mohlcyber
body: Thanks for the review. Order adjusted.
created_at: 2025-05-27T20:54:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -276,3 +276,25 @@ Returns Elasticsearch indices statistics and information. This command is not su
 | Elasticsearch.IndexStatistics.UUID | String | The UUID of the index. |
 | Elasticsearch.IndexStatistics.DocumentsCount | Number | The number of documents that are indexed in the index. |
 | Elasticsearch.IndexStatistics.DocumentsDeleted | Number | The number of documents that were deleted from the index. |
+
+### es-esql-search
+
+***
+Search using ES|QL query. (Elastic >=8.11)
path: Packs/Elasticsearch/Integrations/Elasticsearch_v2/README.md
user: login: mohlcyber
body: Thanks for the review. Done. 
created_at: 2025-05-27T20:55:35Z
author_association: CONTRIBUTOR

PR comments:
user: login: content-bot
created_at: 2025-05-27T11:12:26Z
body: Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the [Contribution Registration](https://forms.gle/XDfxU4E61ZwEESSMA) form, so our content wizard @ilappe will know the proposed changes are ready to be reviewed.
For your convenience, here is a [link](https://xsoar.pan.dev/docs/contributing/sla) to the contributions SLAs document.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-05-27T11:12:27Z
body: Hi @mohlcyber, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this [link](https://xsoar.pan.dev/docs/packs/packs-format#contributorsjson).
author_association: CONTRIBUTOR
user: login: ilappe
created_at: 2025-05-27T11:26:13Z
body: Continue work from https://github.com/demisto/content/pull/39977
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-05-27T12:23:42Z
body: For the Reviewer: Trigger build request has been accepted for this contribution PR.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-05-27T12:23:52Z
body: For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/3558670
author_association: CONTRIBUTOR
user: login: julieschwartz18
created_at: 2025-05-27T13:20:59Z
body: In the meantime, I added the label docs-approved
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-28T06:06:10Z
body: Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.
author_association: NONE