Get data streams

  • GET /_data_stream/{name}
  • GET /_data_stream
Auth

Get information about one or more data streams.

Required authorization

Index privileges view_index_metadata

Path parameters

name union string | string[] optional

Comma-separated list of data stream names used to limit the request. Wildcard (*) expressions are supported. If omitted, all data streams are returned.

Leave it out to use /_data_stream.

Query parameters

expand_wildcards union oneOf · default: open

Type of data stream that wildcard patterns can match. Supports comma-separated values, such as open,hidden.

Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
Values: all open closed hidden none
include_defaults boolean · default: false

If true, returns all relevant default configurations for the index template.

master_timeout string · default: 30s

Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

verbose boolean · default: false

Whether the maximum timestamp for each data stream should be calculated and returned.

Response

application/json
data_streams object[] required
_meta object

Custom metadata for the stream, copied from the _meta object of the stream’s matching index template. If empty, the response omits this property.

allow_custom_routing boolean

If true, the data stream allows custom routing on write request.

failure_store object

Information about failure store backing indices

enabled boolean required
indices object[] required
index_name string required

Name of the backing index.

index_uuid string required

Universally unique identifier (UUID) for the index.

ilm_policy string

Name of the current ILM lifecycle policy configured for this backing index.

managed_by enum

Name of the lifecycle system that's currently managing this backing index.

Values: Index Lifecycle Management Data stream lifecycle Unmanaged
prefer_ilm boolean

Indicates if ILM should take precedence over DSL in case both are configured to manage this index.

index_mode enum

The index mode of this backing index of the data stream.

Values: standard time_series logsdb lookup
rollover_on_write boolean required
generation number required

Current generation for the data stream. This number acts as a cumulative count of the stream’s rollovers, starting at 1.

hidden boolean required

If true, the data stream is hidden.

ilm_policy string

Name of the current ILM lifecycle policy in the stream’s matching index template. This lifecycle policy is set in the index.lifecycle.name setting. If the template does not include a lifecycle policy, this property is not included in the response. NOTE: A data stream’s backing indices may be assigned different lifecycle policies. To retrieve the lifecycle policy for individual backing indices, use the get index settings API.

next_generation_managed_by enum required

Name of the lifecycle system that'll manage the next generation of the data stream.

Values: Index Lifecycle Management Data stream lifecycle Unmanaged
prefer_ilm boolean required

Indicates if ILM should take precedence over DSL in case both are configured to managed this data stream.

indices object[] required

Array of objects containing information about the data stream’s backing indices. The last item in this array contains information about the stream’s current write index.

index_name string required

Name of the backing index.

index_uuid string required

Universally unique identifier (UUID) for the index.

ilm_policy string

Name of the current ILM lifecycle policy configured for this backing index.

managed_by enum

Name of the lifecycle system that's currently managing this backing index.

Values: Index Lifecycle Management Data stream lifecycle Unmanaged
prefer_ilm boolean

Indicates if ILM should take precedence over DSL in case both are configured to manage this index.

index_mode enum

The index mode of this backing index of the data stream.

Values: standard time_series logsdb lookup
lifecycle object

Contains the configuration for the data stream lifecycle of this data stream.

data_retention string

If defined, every document added to this data stream will be stored at least for this time frame. Any time after this duration the document could be deleted. When empty, every document in this data stream will be stored indefinitely.

effective_retention string

The least amount of time data should be kept by elasticsearch.

retention_determined_by enum

Configuration source that can influence the retention of a data stream.

Values: data_stream_configuration default_global_retention max_global_retention default_failures_retention
downsampling object[]

The list of downsampling rounds to execute as part of this downsampling configuration

after string required

The duration since rollover when this downsampling round should execute

fixed_interval string required

The downsample interval.

downsampling_method enum

The method used to downsample the data. There are two options aggregate and last_value. It requires downsampling to be defined. Defaults to aggregate.

Values: aggregate last_value
enabled boolean · default: true

If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle that's disabled (enabled: false) will have no effect on the data stream.

frozen_after string

The period after which data stream backing indices are automatically converted to partially mounted searchable snapshots. This field is valid only on main data stream lifecycles and cannot be set on failure-store lifecycles.

rollover object

The conditions which will trigger the rollover of a backing index as configured by the cluster setting cluster.lifecycle.default.rollover. This property is an implementation detail and it will only be retrieved when the query param include_defaults is set to true. The contents of this field are subject to change.

min_age string
max_age string
min_docs number
max_docs number
min_size number | string
max_size number | string
min_primary_shard_size number | string
max_primary_shard_size number | string
min_primary_shard_docs number
max_primary_shard_docs number
name string required

Name of the data stream.

replicated boolean

If true, the data stream is created and managed by cross-cluster replication and the local cluster can not write into this data stream or change its mappings.

rollover_on_write boolean required

If true, the next write to this data stream will trigger a rollover first and the document will be indexed in the new backing index. If the rollover fails the indexing request will fail too.

settings object required

The settings specific to this data stream that will take precedence over the settings in the matching index template.

mappings object

The mappings specific to this data stream that will take precedence over the mappings in the matching index template.

all_field object
analyzer string required
enabled boolean required
omit_norms boolean required
search_analyzer string required
similarity string required
store boolean required
store_term_vector_offsets boolean required
store_term_vector_payloads boolean required
store_term_vector_positions boolean required
store_term_vectors boolean required
date_detection boolean
dynamic enum
Values: strict runtime true false
dynamic_date_formats string[]
dynamic_templates string to object[]
_field_names object
enabled boolean required
index_field object
enabled boolean required
_meta object
numeric_detection boolean
properties map string to oneOf
_routing object
required boolean required
_size object
enabled boolean required
_source object
enabled boolean
excludes string[]
includes string[]
mode enum

Supported values include:

  • disabled
  • stored
  • columnar_stored
  • synthetic: Instead of storing source documents on disk exactly as you send them, Elasticsearch can reconstruct source content on the fly upon retrieval.
Values: disabled stored columnar_stored synthetic
runtime map string to object
<string> object
fields map string to object

For type composite

<string> object
type enum required
Values: boolean composite date double geo_point geo_shape ip keyword long lookup
fetch_fields object[]

For type lookup

field string required
format string
format string

A custom format for date type runtime fields.

input_field string

For type lookup

target_field string

For type lookup

target_index string

For type lookup

script string

Painless script executed at query time.

on_script_error enum
Values: fail continue
type enum required

Field type, which can be: boolean, composite, date, double, geo_point, ip,keyword, long, or lookup.

Values: boolean composite date double geo_point geo_shape ip keyword long lookup
enabled boolean
subobjects enum
Values: true false
_data_stream_timestamp object
enabled boolean required
status enum required

Health status of the data stream. This health status is based on the state of the primary and replica shards of the stream’s backing indices.

Supported values include:

  • green (or GREEN): All shards are assigned.
  • yellow (or YELLOW): All primary shards are assigned, but one or more replica shards are unassigned. If a node in the cluster fails, some data could be unavailable until that node is repaired.
  • red (or RED): One or more primary shards are unassigned, so some data is unavailable. This can occur briefly during cluster startup as primary shards are assigned.
  • unknown
  • unavailable
Values: green GREEN yellow YELLOW red RED unknown unavailable
system boolean

If true, the data stream is created and managed by an Elastic stack component and cannot be modified through normal user interaction.

template string required

Name of the index template used to create the data stream’s backing indices. The template’s index pattern must match the name of this data stream.

timestamp_field object required

Information about the @timestamp field in the data stream.

name string required

Name of the timestamp field for the data stream, which must be @timestamp. The @timestamp field must be included in every document indexed to the data stream.

index_mode enum

The index mode for the data stream that will be used for newly created backing indices.

Values: standard time_series logsdb lookup