batch-kibana.java

import com.fasterxml.jackson.databind.ObjectMapper;

String content = "{\"params\":{\"preference\":1620226203317,\"index\":\"filebeat*\",\"body\":{\"version\":true,\"size\":2000,\"sort\":[{\"@timestamp\":{\"order\":\"desc\",\"unmapped_type\":\"boolean\"}}],\"aggs\":{\"2\":{\"date_histogram\":{\"field\":\"@timestamp\",\"fixed_interval\":\"3h\",\"time_zone\":\"Europe/Rome\",\"min_doc_count\":1}}},\"stored_fields\":[\"*\"],\"script_fields\":{},\"docvalue_fields\":[{\"field\":\"@timestamp\",\"format\":\"date_time\"},{\"field\":\"azure.enqueued_time\",\"format\":\"date_time\"},{\"field\":\"event.created\",\"format\":\"date_time\"},{\"field\":\"event.end\",\"format\":\"date_time\"},{\"field\":\"event.ingested\",\"format\":\"date_time\"},{\"field\":\"event.start\",\"format\":\"date_time\"},{\"field\":\"file.accessed\",\"format\":\"date_time\"},{\"field\":\"file.created\",\"format\":\"date_time\"},{\"field\":\"file.ctime\",\"format\":\"date_time\"},{\"field\":\"file.mtime\",\"format\":\"date_time\"},{\"field\":\"kafka.block_timestamp\",\"format\":\"date_time\"},{\"field\":\"package.installed\",\"format\":\"date_time\"},{\"field\":\"process.parent.start\",\"format\":\"date_time\"},{\"field\":\"process.start\",\"format\":\"date_time\"},{\"field\":\"tls.client.not_after\",\"format\":\"date_time\"},{\"field\":\"tls.client.not_before\",\"format\":\"date_time\"},{\"field\":\"tls.server.not_after\",\"format\":\"date_time\"},{\"field\":\"tls.server.not_before\",\"format\":\"date_time\"}],\"_source\":{\"excludes\":[]},\"query\":{\"bool\":{\"must\":[],\"filter\":[{\"bool\":{\"filter\":[{\"multi_match\":\n" +
                 "{\"type\":\"phrase\",\"query\":\"TOKEN_TO_REPLACE\",\"lenient\":true}},\n" +
                 "{\"multi_match\":{\"type\":\"phrase\",\"query\":\"another query: \",\"lenient\":true}}]}},\n" +
                 "{\"range\":{\"@timestamp\":{\"gte\":\"2021-04-25T05:22:43.337Z\",\"lte\":\"2021-05-05T15:22:43.337Z\",\"format\":\"strict_date_optional_time\"}}}],\"should\":[],\"must_not\":[]}},\"highlight\":{\"pre_tags\":[\"@kibana-highlighted-field@\"],\"post_tags\":[\"@/kibana-highlighted-field@\"],\"fields\":{\"*\":{}},\"fragment_size\":2147483647}},\"rest_total_hits_as_int\":true,\"ignore_unavailable\":true,\"ignore_throttled\":true,\"timeout\":\"30000ms\"},\"serverStrategy\":\"es\"}";

content = content.replace("TOKEN_TO_REPLACE", "the value to search");

ObjectMapper mapper = new ObjectMapper();
           
Object object = mapper.readValue(content, Object.class);

Related to medium article:

https://medium.com/nerd-for-tech/how-we-recovered-more-than-6k-users-data-using-kibana-api-5770101ec0ae