//lcawley Verified example output 2017-04
[[ml-update-datafeed]]
==== Update Data Feeds

The update data feed API enables you to update certain properties of a data feed.

===== Request

`POST _xpack/ml/datafeeds/<feed_id>/_update`

//===== Description

===== Path Parameters

`feed_id` (required)::
  (string) Identifier for the data feed

===== Request Body

The following properties can be updated after the data feed is created:

`aggregations`::
  (object) If set, the data feed performs aggregation searches.
  For more information, see <<ml-datafeed-resource>>.

`chunking_config`::
  (object) Specifies how data searches are split into time chunks.
  See <<ml-datafeed-chunking-config>>.

`frequency`::
  (time units) The interval at which scheduled queries are made while the data
  feed runs in real time. The default value is either the bucket span for short
  bucket spans, or, for longer bucket spans, a sensible fraction of the bucket
  span. For example: "150s".

`indexes` (required)::
  (array) An array of index names. For example: ["it_ops_metrics"].

`job_id`::
 (string) A numerical character string that uniquely identifies the job.

`query`::
  (object) The {es} query domain-specific language (DSL). This value
  corresponds to the query object in an {es} search POST body. All the
  options that are supported by {es} can be used, as this object is
  passed verbatim to {es}. By default, this property has the following
  value: `{"match_all": {"boost": 1}}`.

`query_delay`::
  (time units) The number of seconds behind real-time that data is queried. For
  example, if data from 10:04 a.m. might not be searchable in {es} until
  10:06 a.m., set this property to 120 seconds. The default value is `60s`.

`scroll_size`::
  (unsigned integer) The `size` parameter that is used in {es} searches.
  The default value is `1000`.

`types` (required)::
  (array) A list of types to search for within the specified indices.
  For example: ["network","sql","kpi"].

For more information about these properties,
see <<ml-datafeed-resource, Data Feed Resources>>.


===== Authorization

You must have `manage_ml`, or `manage` cluster privileges to use this API.
For more information, see <<privileges-list-cluster>>.

===== Examples

The following example updates the `it-ops-kpi` job:

[source,js]
--------------------------------------------------
POST _xpack/ml/datafeeds/datafeed-it-ops-kpi/_update
{
  "query_delay": "60s",
  "frequency": "150s",
  "aggregations": {
        "buckets": {
          "date_histogram": {
            "field": "@timestamp",
            "interval": 30000,
            "offset": 0,
            "order": {
              "_key": "asc"
            },
            "keyed": false,
            "min_doc_count": 0
          },
          "aggregations": {
            "events_per_min": {
              "sum": {
                "field": "events_per_min"
              }
            },
            "@timestamp": {
              "max": {
                "field": "@timestamp"
              }
            }
          }
        }
      },
  "scroll_size": 1000,
  "chunking_config": {
  "mode": "manual",
  "time_span": "30000000ms"
  }
}
--------------------------------------------------
// CONSOLE
// TEST[skip:todo]

When the data feed is updated, you receive the following results:
[source,js]
----
{
  "datafeed_id": "datafeed-it-ops-kpi",
  "job_id": "it-ops-kpi",
  "query_delay": "60s",
  "frequency": "150s",
  ...
  "aggregations": {
    "buckets": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": 30000,
        "offset": 0,
        "order": {
          "_key": "asc"
        },
        "keyed": false,
        "min_doc_count": 0
      },
      "aggregations": {
        "events_per_min": {
          "sum": {
            "field": "events_per_min"
          }
        },
        "@timestamp": {
          "max": {
            "field": "@timestamp"
          }
        }
      }
    }
  },
  "scroll_size": 1000,
  "chunking_config": {
    "mode": "manual",
    "time_span": "30000000ms"
  }
}
----