Add NEST support for EQL Get Search API

src/Elasticsearch.Net/Api/RequestParameters/RequestParameters.Eql.cs

@@ -50,7 +50,7 @@ public class DeleteRequestParameters : RequestParameters<DeleteRequestParameters
 	}
 
 	///<summary>Request options for Get <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
-	public class GetRequestParameters : RequestParameters<GetRequestParameters>
+	public class EqlGetRequestParameters : RequestParameters<EqlGetRequestParameters>
 	{
 		public override HttpMethod DefaultHttpMethod => HttpMethod.GET;
 		public override bool SupportsBody => false;

src/Elasticsearch.Net/ElasticLowLevelClient.Eql.cs

@@ -75,13 +75,13 @@ public Task<TResponse> DeleteAsync<TResponse>(string id, DeleteRequestParameters
 		///<summary>GET on /_eql/search/{id} <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
 		///<param name = "id">The async search ID</param>
 		///<param name = "requestParameters">Request specific configuration such as querystring parameters &amp; request specific connection settings.</param>
-		public TResponse Get<TResponse>(string id, GetRequestParameters requestParameters = null)
+		public TResponse Get<TResponse>(string id, EqlGetRequestParameters requestParameters = null)
 			where TResponse : class, IElasticsearchResponse, new() => DoRequest<TResponse>(GET, Url($"_eql/search/{id:id}"), null, RequestParams(requestParameters));
 		///<summary>GET on /_eql/search/{id} <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
 		///<param name = "id">The async search ID</param>
 		///<param name = "requestParameters">Request specific configuration such as querystring parameters &amp; request specific connection settings.</param>
 		[MapsApi("eql.get", "id")]
-		public Task<TResponse> GetAsync<TResponse>(string id, GetRequestParameters requestParameters = null, CancellationToken ctx = default)
+		public Task<TResponse> GetAsync<TResponse>(string id, EqlGetRequestParameters requestParameters = null, CancellationToken ctx = default)
 			where TResponse : class, IElasticsearchResponse, new() => DoRequestAsync<TResponse>(GET, Url($"_eql/search/{id:id}"), ctx, null, RequestParams(requestParameters));
 		///<summary>GET on /_eql/search/status/{id} <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
 		///<param name = "id">The async search ID</param>

src/Nest/Descriptors.Eql.cs

@@ -48,6 +48,31 @@
 // ReSharper disable RedundantNameQualifier
 namespace Nest
 {
+	///<summary>Descriptor for Get <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
+	public partial class EqlGetDescriptor : RequestDescriptorBase<EqlGetDescriptor, EqlGetRequestParameters, IEqlGetRequest>, IEqlGetRequest
+	{
+		internal override ApiUrls ApiUrls => ApiUrlsLookups.EqlGet;
+		///<summary>/_eql/search/{id}</summary>
+		///<param name = "id">this parameter is required</param>
+		public EqlGetDescriptor(Id id): base(r => r.Required("id", id))
+		{
+		}
+
+		///<summary>Used for serialization purposes, making sure we have a parameterless constructor</summary>
+		[SerializationConstructor]
+		protected EqlGetDescriptor(): base()
+		{
+		}
+
+		// values part of the url path
+		Id IEqlGetRequest.Id => Self.RouteValues.Get<Id>("id");
+		// Request parameters
+		///<summary>Update the time interval in which the results (partial or final) for this search will be available</summary>
+		public EqlGetDescriptor KeepAlive(Time keepalive) => Qs("keep_alive", keepalive);
+		///<summary>Specify the time that the request should block waiting for the final response</summary>
+		public EqlGetDescriptor WaitForCompletionTimeout(Time waitforcompletiontimeout) => Qs("wait_for_completion_timeout", waitforcompletiontimeout);
+	}
+
 	///<summary>Descriptor for SearchStatus <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
 	public partial class EqlSearchStatusDescriptor : RequestDescriptorBase<EqlSearchStatusDescriptor, EqlSearchStatusRequestParameters, IEqlSearchStatusRequest>, IEqlSearchStatusRequest
 	{

src/Nest/ElasticClient.Eql.cs

@@ -54,6 +54,34 @@ internal EqlNamespace(ElasticClient client): base(client)
 		{
 		}
 
+		/// <summary>
+		/// <c>GET</c> request to the <c>eql.get</c> API, read more about this API online:
+		/// <para></para>
+		/// <a href = "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html">https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</a>
+		/// </summary>
+		public EqlGetResponse<TDocument> Get<TDocument>(Id id, Func<EqlGetDescriptor, IEqlGetRequest> selector = null)
+			where TDocument : class => Get<TDocument>(selector.InvokeOrDefault(new EqlGetDescriptor(id: id)));
+		/// <summary>
+		/// <c>GET</c> request to the <c>eql.get</c> API, read more about this API online:
+		/// <para></para>
+		/// <a href = "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html">https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</a>
+		/// </summary>
+		public Task<EqlGetResponse<TDocument>> GetAsync<TDocument>(Id id, Func<EqlGetDescriptor, IEqlGetRequest> selector = null, CancellationToken ct = default)
+			where TDocument : class => GetAsync<TDocument>(selector.InvokeOrDefault(new EqlGetDescriptor(id: id)), ct);
+		/// <summary>
+		/// <c>GET</c> request to the <c>eql.get</c> API, read more about this API online:
+		/// <para></para>
+		/// <a href = "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html">https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</a>
+		/// </summary>
+		public EqlGetResponse<TDocument> Get<TDocument>(IEqlGetRequest request)
+			where TDocument : class => DoRequest<IEqlGetRequest, EqlGetResponse<TDocument>>(request, request.RequestParameters);
+		/// <summary>
+		/// <c>GET</c> request to the <c>eql.get</c> API, read more about this API online:
+		/// <para></para>
+		/// <a href = "https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html">https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</a>
+		/// </summary>
+		public Task<EqlGetResponse<TDocument>> GetAsync<TDocument>(IEqlGetRequest request, CancellationToken ct = default)
+			where TDocument : class => DoRequestAsync<IEqlGetRequest, EqlGetResponse<TDocument>>(request, request.RequestParameters, ct);
 		/// <summary>
 		/// <c>GET</c> request to the <c>eql.get_status</c> API, read more about this API online:
 		/// <para></para>

src/Nest/Requests.Eql.cs

@@ -49,6 +49,52 @@
 // ReSharper disable RedundantNameQualifier
 namespace Nest
 {
+	[InterfaceDataContract]
+	public partial interface IEqlGetRequest : IRequest<EqlGetRequestParameters>
+	{
+		[IgnoreDataMember]
+		Id Id
+		{
+			get;
+		}
+	}
+
+	///<summary>Request for Get <para>https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-search-api.html</para></summary>
+	public partial class EqlGetRequest : PlainRequestBase<EqlGetRequestParameters>, IEqlGetRequest
+	{
+		protected IEqlGetRequest Self => this;
+		internal override ApiUrls ApiUrls => ApiUrlsLookups.EqlGet;
+		///<summary>/_eql/search/{id}</summary>
+		///<param name = "id">this parameter is required</param>
+		public EqlGetRequest(Id id): base(r => r.Required("id", id))
+		{
+		}
+
+		///<summary>Used for serialization purposes, making sure we have a parameterless constructor</summary>
+		[SerializationConstructor]
+		protected EqlGetRequest(): base()
+		{
+		}
+
+		// values part of the url path
+		[IgnoreDataMember]
+		Id IEqlGetRequest.Id => Self.RouteValues.Get<Id>("id");
+		// Request parameters
+		///<summary>Update the time interval in which the results (partial or final) for this search will be available</summary>
+		public Time KeepAlive
+		{
+			get => Q<Time>("keep_alive");
+			set => Q("keep_alive", value);
+		}
+
+		///<summary>Specify the time that the request should block waiting for the final response</summary>
+		public Time WaitForCompletionTimeout
+		{
+			get => Q<Time>("wait_for_completion_timeout");
+			set => Q("wait_for_completion_timeout", value);
+		}
+	}
+
 	[InterfaceDataContract]
 	public partial interface IEqlSearchStatusRequest : IRequest<EqlSearchStatusRequestParameters>
 	{

src/Nest/XPack/Eql/Get/EqlGetRequest.cs

@@ -0,0 +1,29 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+namespace Nest
+{
+	[MapsApi("eql.get.json")]
+	[ReadAs(typeof(EqlGetRequest))]
+	public partial interface IEqlGetRequest { }
+
+	public partial class EqlGetRequest { }
+
+	public partial class EqlGetDescriptor { }
+}

src/Nest/XPack/Eql/Get/EqlGetResponse.cs

@@ -0,0 +1,28 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+namespace Nest
+{
+	/// <summary>
+	/// A response to an EQL get async search request.
+	/// </summary>
+	public class EqlGetResponse<TDocument> : EqlSearchResponse<TDocument> where TDocument : class
+	{
+	}
+}

src/Nest/_Generated/ApiUrlsLookup.generated.cs

@@ -106,6 +106,7 @@ internal static class ApiUrlsLookups
 		internal static ApiUrls EnrichGetPolicy = new ApiUrls(new[]{"_enrich/policy/{name}", "_enrich/policy/"});
 		internal static ApiUrls EnrichPutPolicy = new ApiUrls(new[]{"_enrich/policy/{name}"});
 		internal static ApiUrls EnrichStats = new ApiUrls(new[]{"_enrich/_stats"});
+		internal static ApiUrls EqlGet = new ApiUrls(new[]{"_eql/search/{id}"});
 		internal static ApiUrls EqlSearchStatus = new ApiUrls(new[]{"_eql/search/status/{id}"});
 		internal static ApiUrls EqlSearch = new ApiUrls(new[]{"{index}/_eql/search"});
 		internal static ApiUrls NoNamespaceDocumentExists = new ApiUrls(new[]{"{index}/_doc/{id}"});

tests/Tests.Configuration/tests.default.yaml

@@ -5,11 +5,11 @@
 # tracked by git).
 
 # mode either u (unit test), i (integration test) or m (mixed mode)
-mode: i
+mode: u
 
 # the elasticsearch version that should be started
 # Can be a snapshot version of sonatype or "latest" to get the latest snapshot of sonatype
-elasticsearch_version: 7.13.0-SNAPSHOT
+elasticsearch_version: latest
 # cluster filter allows you to only run the integration tests of a particular cluster (cluster suffix not needed)
 # cluster_filter:
 # whether we want to forcefully reseed on the node, if you are starting the tests with a node already running

tests/Tests/XPack/Eql/EqlSearchApiCoordinatedTests.cs

@@ -17,6 +17,8 @@
  * under the License.
  */
 
+using System;
+using System.Linq;
 using System.Threading.Tasks;
 using Elastic.Elasticsearch.Xunit.XunitPlumbing;
 using FluentAssertions;
@@ -34,6 +36,8 @@ public class EqlSearchApiCoordinatedTests : CoordinatedIntegrationTestBase<TimeS
 	{
 		private const string SubmitStep = nameof(SubmitStep);
 		private const string StatusStep = nameof(StatusStep);
+		private const string GetStep = nameof(GetStep);
+		private const string WaitStep = nameof(WaitStep);
 
 		public EqlSearchApiCoordinatedTests(TimeSeriesCluster cluster, EndpointUsage usage) : base(new CoordinatedUsage(cluster, usage, testOnlyOne: true)
 		{
@@ -68,6 +72,30 @@ public EqlSearchApiCoordinatedTests(TimeSeriesCluster cluster, EndpointUsage usa
 					(v, c, r) => c.Eql.SearchStatusAsync(r),
 					uniqueValueSelector: values => values.ExtendedValue<string>("id")
 				)
+			},
+			{WaitStep, u => u.Call(async (v, c) =>
+			{
+				// wait for the search to complete
+				var complete = false;
+				var count = 0;
+
+				while (!complete && count++ < 10)
+				{
+					await Task.Delay(100);
+					var status = await c.Eql.SearchStatusAsync(u.Usage.CallUniqueValues.ExtendedValue<string>("id"));
+					complete = !status.IsRunning;
+				}
+			})}, // allows the search to complete
+			{GetStep, u =>
+				u.Calls<EqlGetDescriptor, EqlGetRequest, IEqlGetRequest, EqlGetResponse<Log>>(
+					v => new EqlGetRequest(v),
+					(v, d) => d,
+					(v, c, f) => c.Eql.Get<Log>(v, f),
+					(v, c, f) => c.Eql.GetAsync<Log>(v, f),
+					(v, c, r) => c.Eql.Get<Log>(r),
+					(v, c, r) => c.Eql.GetAsync<Log>(r),
+					uniqueValueSelector: values => values.ExtendedValue<string>("id")
+				)
 			}
 		}) { }
 
@@ -89,5 +117,22 @@ [I] public async Task EqlSearchStatusResponse() => await Assert<EqlSearchStatusR
 			r.ExpirationTimeInMillis.Should().BeGreaterThan(0);
 			r.StartTimeInMillis.Should().BeGreaterThan(0);
 		});
+
+		[I] public async Task EqlGetResponse() => await Assert<EqlGetResponse<Log>>(GetStep, r =>
+		{
+			r.ShouldBeValid();
+			r.IsPartial.Should().BeFalse();
+			r.IsRunning.Should().BeFalse();
+			r.Took.Should().BeGreaterOrEqualTo(0);
+			r.TimedOut.Should().BeFalse();
+			r.Events.Count.Should().Be(10);
+			r.EqlHitsMetadata.Total.Value.Should().Be(10);
+			r.Total.Should().Be(10);
+
+			var firstEvent = r.Events.First();
+			firstEvent.Index.Should().StartWith("customlogs-");
+			firstEvent.Id.Should().NotBeNullOrEmpty();
+			firstEvent.Source.Event.Category.Should().BeOneOf(Log.EventCategories);
+		});
 	}
 }

tests/Tests/XPack/Eql/Get/EqlGetUrlTests.cs

@@ -0,0 +1,37 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+using System.Threading.Tasks;
+using Elastic.Elasticsearch.Xunit.XunitPlumbing;
+using Nest;
+using Tests.Domain;
+using Tests.Framework.EndpointTests;
+using static Tests.Framework.EndpointTests.UrlTester;
+
+namespace Tests.XPack.Eql.Get
+{
+	public class EqlGetUrlTests : UrlTestsBase
+	{
+		[U] public override async Task Urls() => await GET("/_eql/search/search_id")
+			.Fluent(c => c.Eql.Get<Log>("search_id", f => f))
+			.Request(c => c.Eql.Get<Log>(new EqlGetRequest("search_id")))
+			.FluentAsync(c => c.Eql.GetAsync<Log>("search_id", f => f))
+			.RequestAsync(c => c.Eql.GetAsync<Log>(new EqlGetRequest("search_id")));
+	}
+}