---
type: api
title: Start datafeeds
description: A datafeed must be started in order to retrieve data from Elasticsearch. A datafeed can be started and stopped
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ml-start-datafeed
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ml-start-datafeed
products:
  - Elasticsearch
---

# Start datafeeds

Availability: 5.5+

## Paths

- `POST` `/_ml/datafeeds/{datafeed_id}/_start`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

#### Path Parameters

- `datafeed_id` (string Id)
  A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase
alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric
characters.

## Description

A datafeed must be started in order to retrieve data from Elasticsearch. A datafeed can be started and stopped
multiple times throughout its lifecycle.

Before you can start a datafeed, the anomaly detection job must be open. Otherwise, an error occurs.

If you restart a stopped datafeed, it continues processing input data from the next millisecond after it was stopped.
If new data was indexed for that exact millisecond between stopping and starting, it will be ignored.

When Elasticsearch security features are enabled, your datafeed remembers which roles the last user to create or
update it had at the time of creation or update and runs the query using those same roles. If you provided secondary
authorization headers when you created or updated the datafeed, those credentials are used instead.

## Required authorization

* Cluster privileges: `manage_ml`

## Query String Parameters

- `end` (union DateTime)
  The time that the datafeed should end, which can be specified by using one of the following formats:

* ISO 8601 format with milliseconds, for example `2017-01-22T06:00:00.000Z`
* ISO 8601 format without milliseconds, for example `2017-01-22T06:00:00+00:00`
* Milliseconds since the epoch, for example `1485061200000`

Date-time arguments using either of the ISO 8601 formats must have a time zone designator, where `Z` is accepted
as an abbreviation for UTC time. When a URL is expected (for example, in browsers), the `+` used in time zone
designators must be encoded as `%2B`.
The end time value is exclusive. If you do not specify an end time, the datafeed
runs continuously.
  One of: `string` or `EpochTimeUnitMillis`
- `start` (union DateTime)
  The time that the datafeed should begin, which can be specified by using the same formats as the `end` parameter.
This value is inclusive.
If you do not specify a start time and the datafeed is associated with a new anomaly detection job, the analysis
starts from the earliest time for which data is available.
If you restart a stopped datafeed and specify a start value that is earlier than the timestamp of the latest
processed record, the datafeed continues from 1 millisecond after the timestamp of the latest processed record.
  One of: `string` or `EpochTimeUnitMillis`
- `timeout` (string Duration · default: 20s)
  Specifies the amount of time to wait until a datafeed starts.

## Request Body

`application/json`

- `end` (DateTime) — optional
  Refer to the description for the `end` query parameter.
- `start` (DateTime) — optional
  Refer to the description for the `start` query parameter.
- `timeout` (string Duration · default: 20s) — optional
  Refer to the description for the `timeout` query parameter.

## Response

`application/json`

- `node` (NodeIds)
  The ID of the node that the job was started on. In serverless this will be the "serverless".
If the job is allowed to open lazily and has not yet been assigned to a node, this value is an empty string.
- `started` (boolean)
  For a successful response, this value is always `true`. On failure, an exception is returned instead.
## Code Examples

#### Console

```console
POST _ml/datafeeds/datafeed-low_request_rate/_start
{
  "start": "2019-04-07T18:22:16Z"
}
```

#### JavaScript

```javascript
const response = await client.ml.startDatafeed({
  datafeed_id: "datafeed-low_request_rate",
  start: "2019-04-07T18:22:16Z",
});
```

#### Python

```python
resp = client.ml.start_datafeed(
    datafeed_id="datafeed-low_request_rate",
    start="2019-04-07T18:22:16Z",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-low_request_rate/_start" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "start": "2019-04-07T18:22:16Z"
  }'
```

#### Java

```java
client.ml().startDatafeed(s -> s
    .datafeedId("datafeed-low_request_rate")
    .start(DateTime.of("2019-04-07T18:22:16Z"))
);
```

#### C#

```c#
var response = await client.MachineLearning
    .StartDatafeedAsync(datafeedId: "datafeed-low_request_rate", d1 => d1
        .Start(DateTimeOffset.Parse("2019-04-07T18:22:16.0000000+00:00", CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind))
    );
```

#### PHP

```php
$resp = $client->ml()->startDatafeed([
    "datafeed_id" => "datafeed-low_request_rate",
    "body" => [
        "start" => "2019-04-07T18:22:16Z",
    ],
]);
```

#### Ruby

```ruby
response = client.ml.start_datafeed(
  datafeed_id: "datafeed-low_request_rate",
  body: {
    "start": "2019-04-07T18:22:16Z"
  }
)
```