Get datafeeds configuration info
- GET /_ml/datafeeds/{datafeed_id}
- GET /_ml/datafeeds
You can get information for multiple datafeeds in a single API request by
using a comma-separated list of datafeeds or a wildcard expression. You can
get information for all datafeeds by using _all, by specifying * as the
<feed_id>, or by omitting the <feed_id>.
This API returns a maximum of 10,000 datafeeds.
- Cluster privileges:
monitor_ml
Path Parameters
-
datafeed_idId | Idoptional -
Identifier for the datafeed. It can be a datafeed identifier or a wildcard expression. If you do not specify one of these options, the API returns information about all datafeeds.
Leave it out to use
/_ml/datafeeds.
Query Parameters
-
allow_no_matchboolean Specifies what to do when the request:
- Contains wildcard expressions and there are no datafeeds that match.
- Contains the
_allstring or no identifiers and there are no matches. - Contains wildcard expressions and there are only partial matches.
The default value is
true, which returns an emptydatafeedsarray when there are no matches and the subset of results when there are partial matches. If this parameter isfalse, the request returns a404status code when there are no matches or only partial matches.-
exclude_generatedboolean · default: false Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.
Response
-
countnumberrequired -
datafeedsDatafeedrequired -
aggregationsmap string to AggregationContainer -
The security privileges that the datafeed uses to run its queries. If Elastic Stack security features were disabled at the time of the most recent update to the datafeed, this property is omitted.
-
If an API key was used for the most recent update to the datafeed, its name and identifier are listed in the response.
-
The identifier for the API key.
-
The name of the API key.
-
If a user ID was used for the most recent update to the datafeed, its roles at the time of the update are listed in the response.
-
If a service account was used for the most recent update to the datafeed, the account name is listed in the response.
-
chunking_configChunkingConfig -
modeChunkingModerequired -
If the mode is
auto, the chunk size is dynamically calculated; this is the recommended value when the datafeed does not use aggregations. If the mode ismanual, chunking is applied according to the specifiedtime_span; use this mode when the datafeed uses aggregations. If the mode isoff, no chunking is applied. -
Values:
automanualoff -
time_spanstring Duration · default: 3h -
The time span that each search will be querying. This setting is applicable only when the
modeis set tomanual. -
datafeed_idstring Idrequired -
frequencystring Duration -
The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example:
150s. Whenfrequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. -
indicesstringrequired -
indexesstring -
job_idstring Idrequired -
max_empty_searchesnumber -
query_delaystring Duration -
script_fieldsmap string to ScriptField -
<string>ScriptField -
scriptstring Scriptrequired -
ignore_failureboolean -
scroll_sizenumber -
delayed_data_check_configDelayedDataCheckConfigrequired -
check_windowstring Duration -
The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs. In particular, the defaultcheck_windowspan calculation is based on the maximum of2hor8 * bucket_span. -
enabledbooleanrequired -
Specifies whether the datafeed periodically checks for delayed data.
-
runtime_mappingsRuntimeFields -
indices_optionsIndicesOptions -
allow_no_indicesboolean -
A setting that does two separate checks on the index expression. If
false, the request returns an error (1) if any wildcard expression (including_alland*) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. Iftrue, index expressions that resolve to no indices are allowed and the request returns an empty result. -
expand_wildcardsstring ExpandWildcards -
Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as
open,hidden.Supported values include:
all: Match any data stream or index, including hidden ones.open: Match open, non-hidden indices. Also matches any non-hidden data stream.closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.hidden: Match hidden data streams and hidden indices. Must be combined withopen,closed, orboth.none: Wildcard expressions are not accepted.
-
Values:
allopenclosedhiddennone -
If
false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. Iftrue, unavailable concrete targets are silently ignored. -
ignore_throttledboolean · default: true -
If true, concrete, expanded or aliased indices are ignored when frozen.
-
queryobjectrequired -
The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default, this property has the following value:
{"match_all": {"boost": 1}}. - Query DSL