OpenSearch/docs/reference/ml/apis/put-datafeed.asciidoc

[role="xpack"]
[testenv="platinum"]
[[ml-put-datafeed]]
=== Create {dfeeds} API
++++
<titleabbrev>Create {dfeeds}</titleabbrev>
++++

Instantiates a {dfeed}.


==== Request

`PUT _ml/datafeeds/<feed_id>`


==== Description

You must create a job before you create a {dfeed}.  You can associate only one
{dfeed} to each job.


==== Path Parameters

`feed_id` (required)::
  (string) A numerical character string that uniquely identifies the {dfeed}.


==== Request Body

`aggregations`::
  (object) If set, the {dfeed} performs aggregation searches.
  For more information, see <<ml-datafeed-resource>>.

`chunking_config`::
  (object) Specifies how data searches are split into time chunks.
  See <<ml-datafeed-chunking-config>>.

`frequency`::
  (time units) The interval at which scheduled queries are made while the {dfeed}
  runs in real time. The default value is either the bucket span for short
  bucket spans, or, for longer bucket spans, a sensible fraction of the bucket
  span. For example: `150s`.

`indices` (required)::
  (array) An array of index names. Wildcards are supported. For example:
  `["it_ops_metrics", "server*"]`.

`job_id` (required)::
 (string) A numerical character string that uniquely identifies the job.

`query`::
  (object) The {es} query domain-specific language (DSL). This value
  corresponds to the query object in an {es} search POST body. All the
  options that are supported by {Es} can be used, as this object is
  passed verbatim to {es}. By default, this property has the following
  value: `{"match_all": {"boost": 1}}`.

`query_delay`::
  (time units) The number of seconds behind real time that data is queried. For
  example, if data from 10:04 a.m. might not be searchable in {es} until
  10:06 a.m., set this property to 120 seconds. The default value is `60s`.

`script_fields`::
  (object) Specifies scripts that evaluate custom expressions and returns
  script fields to the {dfeed}.
  The <<ml-detectorconfig,detector configuration objects>> in a job can contain
  functions that use these script fields.
  For more information,
  see {ref}/search-request-script-fields.html[Script Fields].

`scroll_size`::
  (unsigned integer) The `size` parameter that is used in {es} searches.
  The default value is `1000`.

`delayed_data_check_config`::
  (object) Specifies if and with how large a window should the data feed check
  for missing data. See <<ml-datafeed-delayed-data-check-config>>.

For more information about these properties,
see <<ml-datafeed-resource>>.


==== Authorization

If {es} {security-features} are enabled, you must have `manage_ml`, or `manage`
cluster privileges to use this API. For more information, see
{stack-ov}/security-privileges.html[Security Privileges].


==== Security integration

When {es} {security-features} are enabled, your {dfeed} remembers which roles the
user who created it had at the time of creation and runs the query using those
same roles.


==== Examples

The following example creates the `datafeed-total-requests` {dfeed}:

[source,js]
--------------------------------------------------
PUT _ml/datafeeds/datafeed-total-requests
{
  "job_id": "total-requests",
  "indices": ["server-metrics"]
}
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:server_metrics_job]

When the {dfeed} is created, you receive the following results:
[source,js]
----
{
  "datafeed_id": "datafeed-total-requests",
  "job_id": "total-requests",
  "query_delay": "83474ms",
  "indices": [
    "server-metrics"
  ],
  "query": {
    "match_all": {
      "boost": 1.0
    }
  },
  "scroll_size": 1000,
  "chunking_config": {
    "mode": "auto"
  }
}
----
// TESTRESPONSE[s/"query_delay": "83474ms"/"query_delay": $body.query_delay/]
// TESTRESPONSE[s/"query.boost": "1.0"/"query.boost": $body.query.boost/]