Docs
-->
Elasticsearch Reference [7.0] » X-Pack APIs » Machine learning APIs » Create datafeeds API
«  Create calendar API     Create filter API  »

Create datafeeds API

Instantiates a datafeed.

Request

PUT _ml/datafeeds/<feed_id>

Description

You must create a job before you create a datafeed. You can associate only one datafeed to each job.

Important

You must use Kibana or this API to create a datafeed. Do not put a datafeed directly to the .ml-config index using the Elasticsearch index API. If Elasticsearch security features are enabled, do not give users write privileges on the .ml-config index.

Path Parameters

feed_id (required)
(string) A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.

Request Body

aggregations
(object) If set, the datafeed performs aggregation searches. For more information, see Datafeed resources.
chunking_config
(object) Specifies how data searches are split into time chunks. See Chunking Configuration Objects.
frequency
(time units) The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: 150s.
indices (required)
(array) An array of index names. Wildcards are supported. For example: ["it_ops_metrics", "server*"].
job_id (required)
(string) A numerical character string that uniquely identifies the job.
query
(object) The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default, this property has the following value: {"match_all": {"boost": 1}}.
query_delay
(time units) The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is 60s.
script_fields
(object) Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. For more information, see Script Fields.
scroll_size
(unsigned integer) The size parameter that is used in Elasticsearch searches. The default value is 1000.
delayed_data_check_config
(object) Specifies if and with how large a window should the data feed check for missing data. See Delayed Data Check Configuration Objects.

For more information about these properties, see Datafeed resources.

Authorization

If Elasticsearch security features are enabled, you must have manage_ml, or manage cluster privileges to use this API. For more information, see Security Privileges.

Security integration

When Elasticsearch security features are enabled, your datafeed remembers which roles the user who created it had at the time of creation and runs the query using those same roles.

Examples

The following example creates the datafeed-total-requests datafeed:

PUT _ml/datafeeds/datafeed-total-requests
{
  "job_id": "total-requests",
  "indices": ["server-metrics"]
}

When the datafeed is created, you receive the following results:

{
  "datafeed_id": "datafeed-total-requests",
  "job_id": "total-requests",
  "query_delay": "83474ms",
  "indices": [
    "server-metrics"
  ],
  "query": {
    "match_all": {
      "boost": 1.0
    }
  },
  "scroll_size": 1000,
  "chunking_config": {
    "mode": "auto"
  }
}
«  Create calendar API     Create filter API  »