OpenSearch/docs/en/rest-api/ml/put-datafeed.asciidoc

//lcawley Verified example output 2017-04-11
[[ml-put-datafeed]]
==== Create Data Feeds

The create data feed API enables you to instantiate a data feed.


===== Request

`PUT _xpack/ml/datafeeds/<feed_id>`


===== Description

You must create a job before you create a data feed.  You can associate only one
data feed to each job.


===== Path Parameters

`feed_id` (required)::
  (string) A numerical character string that uniquely identifies the data feed.


===== Request Body

`aggregations`::
  (object) If set, the data feed performs aggregation searches.
  For more information, see <<ml-datafeed-resource>>.

`chunking_config`::
  (object) The chunking configuration, which specifies how data searches are
  chunked. See <<ml-datafeed-chunking-config>>.

`frequency`::
  (time units) The interval at which scheduled queries are made while the data
  feed runs in real time. The default value is either the bucket span for short
  bucket spans, or, for longer bucket spans, a sensible fraction of the bucket
  span. For example: "150s".

`indexes` (required)::
  (array) An array of index names. For example: ["it_ops_metrics"].

`job_id` (required)::
 (string) A numerical character string that uniquely identifies the job.

`query`::
  (object) The Elasticsearch query domain-specific language (DSL). This value
  corresponds to the query object in an Elasticsearch search POST body. All the
  options that are supported by Elasticsearch can be used, as this object is
  passed verbatim to Elasticsearch. By default, this property has the following
  value: `{"match_all": {"boost": 1}}`. If this property is not specified, the
  default value is `“match_all”: {}`.

`query_delay`::
  (time units) The number of seconds behind real-time that data is queried. For
  example, if data from 10:04 a.m. might not be searchable in Elasticsearch
  until 10:06 a.m., set this property to 120 seconds. The default value is 60
  seconds. For example: "60s".

`scroll_size`::
  (unsigned integer) The `size` parameter that is used in Elasticsearch searches.
  The default value is `1000`.

`types` (required)::
  (array) A list of types to search for within the specified indices.
  For example: ["network","sql","kpi"].

For more information about these properties,
see <<ml-datafeed-resource, Data Feed Resources>>.


===== Authorization

You must have `manage_ml`, or `manage` cluster privileges to use this API.
For more information, see <<privileges-list-cluster>>.

===== Examples

The following example creates the `datafeed-it-ops-kpi` data feed:

[source,js]
--------------------------------------------------
PUT _xpack/ml/datafeeds/datafeed-it-ops-kpi
{
  "job_id": "it-ops-kpi",
  "indexes": ["it_ops_metrics"],
  "types": ["kpi","network","sql"],
  "query": {
    "match_all": {
          "boost": 1
    }
  }
}
--------------------------------------------------
// CONSOLE
// TEST[skip:todo]

When the data feed is created, you receive the following results:
[source,js]
----
{
  "datafeed_id": "datafeed-it-ops-kpi",
  "job_id": "it-ops-kpi",
  "query_delay": "1m",
  "indexes": [
    "it_ops_metrics"
  ],
  "types": [
    "kpi",
    "network",
    "sql"
  ],
  "query": {
    "match_all": {
      "boost": 1
    }
  },
  "scroll_size": 1000,
  "chunking_config": {
    "mode": "auto"
  }
}
----