Create or update an ES|QL data source

PUT /_query/data_source/{name}

Creates or replaces a named, type-specific data source configuration for ES|QL data federation. Datasets reference data source configurations to access external data. Names must be lowercase and follow index or alias naming rules.

ES|QL Data Federation

Required authorization

Authentication

Authorization: <value>

Elasticsearch APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

For more information about where to find API keys for the Elasticsearch endpoint (${ES_URL}) for a project, go to Get started with Elasticsearch Serverless.

Path parameters

Query parameters

Request body

Response

application/json

Examples

Request Console 1 / 7 languages

Create a data source for production logs stored in Amazon S3. The data source uses static credentials and connects to a bucket in the us-east-1 region.

Console Kibana Dev Tools

PUT /_query/data_source/prod_s3_logs
{
  "type": "s3",
  "description": "Production S3 logs bucket",
  "settings": {
    "region": "us-east-1",
    "auth": "static_credentials",
    "access_key": "<AWS_ACCESS_KEY_ID>",
    "secret_key": "<AWS_SECRET_ACCESS_KEY>"
  }
}

JavaScript Elasticsearch JavaScript Client

const response = await client.esql.putDataSource({
  name: "prod_s3_logs",
  type: "s3",
  description: "Production S3 logs bucket",
  settings: {
    region: "us-east-1",
    auth: "static_credentials",
    access_key: "<AWS_ACCESS_KEY_ID>",
    secret_key: "<AWS_SECRET_ACCESS_KEY>",
  },
});

Python Elasticsearch Python Client

resp = client.esql.put_data_source(
    name="prod_s3_logs",
    type="s3",
    description="Production S3 logs bucket",
    settings={
        "region": "us-east-1",
        "auth": "static_credentials",
        "access_key": "<AWS_ACCESS_KEY_ID>",
        "secret_key": "<AWS_SECRET_ACCESS_KEY>"
    },
)

curl Shell

curl -X PUT "$ELASTICSEARCH_URL/_query/data_source/prod_s3_logs" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "s3",
    "description": "Production S3 logs bucket",
    "settings": {
      "region": "us-east-1",
      "auth": "static_credentials",
      "access_key": "\u003CAWS_ACCESS_KEY_ID\u003E",
      "secret_key": "\u003CAWS_SECRET_ACCESS_KEY\u003E"
    }
  }'

Java Elasticsearch Java Client

client.esql().putDataSource(p -> p
    .description("Production S3 logs bucket")
    .name("prod_s3_logs")
    .settings(Map.of("secret_key", JsonData.fromJson("\"<AWS_SECRET_ACCESS_KEY>\""),"auth", JsonData.fromJson("\"static_credentials\""),"access_key", JsonData.fromJson("\"<AWS_ACCESS_KEY_ID>\""),"region", JsonData.fromJson("\"us-east-1\"")))
    .type("s3")
);

PHP Elasticsearch PHP Client

$resp = $client->esql()->putDataSource([
    "name" => "prod_s3_logs",
    "body" => [
        "type" => "s3",
        "description" => "Production S3 logs bucket",
        "settings" => [
            "region" => "us-east-1",
            "auth" => "static_credentials",
            "access_key" => "<AWS_ACCESS_KEY_ID>",
            "secret_key" => "<AWS_SECRET_ACCESS_KEY>",
        ],
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.esql.put_data_source(
  name: "prod_s3_logs",
  body: {
    "type": "s3",
    "description": "Production S3 logs bucket",
    "settings": {
      "region": "us-east-1",
      "auth": "static_credentials",
      "access_key": "<AWS_ACCESS_KEY_ID>",
      "secret_key": "<AWS_SECRET_ACCESS_KEY>"
    }
  }
)

Response

The data source configuration was stored successfully.

{
  "acknowledged": true
}

Required authorization

Authentication

Path parameters

Query parameters

Request body { }

Response

Request body