[role="xpack"]
[[ml-preview-datafeed]]
=== Preview {dfeeds-cap} API
++++
<titleabbrev>Preview {dfeeds-cap}</titleabbrev>
++++

The preview {dfeed} API enables you to preview a {dfeed}.


==== Request

`GET _xpack/ml/datafeeds/<datafeed_id>/_preview`


==== Description

The API returns the first "page" of results from the `search` that is created
by using the current {dfeed} settings. This preview shows the structure of
the data that will be passed to the anomaly detection engine.


==== Path Parameters

`datafeed_id` (required)::
  (string) Identifier for the {dfeed}


==== Authorization

You must have `monitor_ml`, `monitor`, `manage_ml`, or `manage` cluster
privileges to use this API. For more information, see
{xpack-ref}/security-privileges.html[Security Privileges].
//<<privileges-list-cluster>>.


==== Security Integration

When {security} is enabled, the {dfeed} query will be previewed using the
credentials of the user calling the preview {dfeed} API.  When the {dfeed}
is started it will run the query using the roles of the last user to
create or update it.  If the two sets of roles differ then the preview may
not accurately reflect what the {dfeed} will return when started.  To avoid
such problems, the same user that creates/updates the {dfeed} should preview
it to ensure it is returning the expected data.


==== Examples

The following example obtains a preview of the `datafeed-farequote` {dfeed}:

[source,js]
--------------------------------------------------
GET _xpack/ml/datafeeds/datafeed-farequote/_preview
--------------------------------------------------
// CONSOLE
// TEST[skip:todo]

The data that is returned for this example is as follows:
[source,js]
----
[
  {
    "@timestamp": 1454803200000,
    "airline": "AAL",
    "responsetime": 132.20460510253906
  },
  {
    "@timestamp": 1454803200000,
    "airline": "JZA",
    "responsetime": 990.4628295898438
  },
  {
    "@timestamp": 1454803200000,
    "airline": "JBU",
    "responsetime": 877.5927124023438
  },
  ...
]
----