Get datafeeds configuration info

Auth

You can get information for multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can get information for all datafeeds by using _all, by specifying * as the <feed_id>, or by omitting the <feed_id>. This API returns a maximum of 10,000 datafeeds.

Required authorization

Cluster privileges monitor_ml

Path parameters

datafeed_id union string | string[] optional

Identifier for the datafeed. It can be a datafeed identifier or a wildcard expression. If you do not specify one of these options, the API returns information about all datafeeds.

Leave it out to use /_ml/datafeeds.

Query parameters

allow_no_match boolean

Specifies what to do when the request:

  1. Contains wildcard expressions and there are no datafeeds that match.
  2. Contains the _all string or no identifiers and there are no matches.
  3. Contains wildcard expressions and there are only partial matches.

The default value is true, which returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If this parameter is false, the request returns a 404 status code when there are no matches or only partial matches.

exclude_generated boolean · default: false

Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.

Response

application/json
count number required
datafeeds object[] required
aggregations map string to {} Aggregation
authorization object

The security privileges that the datafeed uses to run its queries. If Elastic Stack security features were disabled at the time of the most recent update to the datafeed, this property is omitted.

api_key object

If an API key was used for the most recent update to the datafeed, its name and identifier are listed in the response.

id string required

The identifier for the API key.

name string required

The name of the API key.

roles string[]

If a user ID was used for the most recent update to the datafeed, its roles at the time of the update are listed in the response.

service_account string

If a service account was used for the most recent update to the datafeed, the account name is listed in the response.

chunking_config object
mode enum required

If the mode is auto, the chunk size is dynamically calculated; this is the recommended value when the datafeed does not use aggregations. If the mode is manual, chunking is applied according to the specified time_span; use this mode when the datafeed uses aggregations. If the mode is off, no chunking is applied.

Values: auto manual off
time_span string · default: 3h

The time span that each search will be querying. This setting is applicable only when the mode is set to manual.

datafeed_id string required
frequency string

The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: 150s. When frequency is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.

indices string[] required
indexes string[]
job_id string required
max_empty_searches number
query_delay string
script_fields map string to object
<string> object
script string required
ignore_failure boolean
scroll_size number
delayed_data_check_config object required
check_window string

The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate check_window to be calculated when the real-time datafeed runs. In particular, the default check_window span calculation is based on the maximum of 2h or 8 * bucket_span.

enabled boolean required

Specifies whether the datafeed periodically checks for delayed data.

runtime_mappings object
indices_options object
allow_no_indices boolean

A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

expand_wildcards union oneOf

Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values, such as open,hidden.

Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
Values: all open closed hidden none
ignore_unavailable boolean · default: false

If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

ignore_throttled boolean · default: true

If true, concrete, expanded or aliased indices are ignored when frozen.

query object required

The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default, this property has the following value: {"match_all": {"boost": 1}}.

Query DSL