144 lines
4.4 KiB
Plaintext
144 lines
4.4 KiB
Plaintext
[role="xpack"]
|
|
[testenv="platinum"]
|
|
[[ml-put-datafeed]]
|
|
=== Create {dfeeds} API
|
|
|
|
[subs="attributes"]
|
|
++++
|
|
<titleabbrev>Create {dfeeds}</titleabbrev>
|
|
++++
|
|
|
|
Instantiates a {dfeed}.
|
|
|
|
[[ml-put-datafeed-request]]
|
|
==== {api-request-title}
|
|
|
|
`PUT _ml/datafeeds/<feed_id>`
|
|
|
|
[[ml-put-datafeed-prereqs]]
|
|
==== {api-prereq-title}
|
|
|
|
* If {es} {security-features} are enabled, you must have `manage_ml` or `manage`
|
|
cluster privileges to use this API. See
|
|
{stack-ov}/security-privileges.html[Security privileges].
|
|
|
|
[[ml-put-datafeed-desc]]
|
|
==== {api-description-title}
|
|
|
|
You must create a job before you create a {dfeed}. You can associate only one
|
|
{dfeed} to each job.
|
|
|
|
[IMPORTANT]
|
|
====
|
|
* You must use {kib} or this API to create a {dfeed}. Do not put a
|
|
{dfeed} directly to the `.ml-config` index using the {es} index API. If {es}
|
|
{security-features} are enabled, do not give users `write` privileges on the
|
|
`.ml-config` index.
|
|
* When {es} {security-features} are enabled, your {dfeed} remembers which roles
|
|
the user who created it had at the time of creation and runs the query using
|
|
those same roles.
|
|
====
|
|
|
|
[[ml-put-datafeed-path-parms]]
|
|
==== {api-path-parms-title}
|
|
|
|
`<feed_id>` (Required)::
|
|
(string) A numerical character string that uniquely identifies the {dfeed}.
|
|
This identifier can contain lowercase alphanumeric characters (a-z and 0-9),
|
|
hyphens, and underscores. It must start and end with alphanumeric characters.
|
|
|
|
[[ml-put-datafeed-request-body]]
|
|
==== {api-request-body-title}
|
|
|
|
`aggregations` (Optional)::
|
|
(object) If set, the {dfeed} performs aggregation searches.
|
|
For more information, see <<ml-datafeed-resource>>.
|
|
|
|
`chunking_config` (Optional)::
|
|
(object) Specifies how data searches are split into time chunks.
|
|
See <<ml-datafeed-chunking-config>>.
|
|
|
|
`delayed_data_check_config` (Optional)::
|
|
(object) Specifies whether the data feed checks for missing data and
|
|
the size of the window. See
|
|
<<ml-datafeed-delayed-data-check-config>>.
|
|
|
|
`frequency` (Optional)::
|
|
(time units) The interval at which scheduled queries are made while the {dfeed}
|
|
runs in real time. The default value is either the bucket span for short
|
|
bucket spans, or, for longer bucket spans, a sensible fraction of the bucket
|
|
span. For example: `150s`.
|
|
|
|
`indices` (Required)::
|
|
(array) An array of index names. Wildcards are supported. For example:
|
|
`["it_ops_metrics", "server*"]`.
|
|
|
|
`job_id` (Required)::
|
|
(string) A numerical character string that uniquely identifies the job.
|
|
|
|
`query` (Optional)::
|
|
(object) The {es} query domain-specific language (DSL). This value
|
|
corresponds to the query object in an {es} search POST body. All the
|
|
options that are supported by {Es} can be used, as this object is
|
|
passed verbatim to {es}. By default, this property has the following
|
|
value: `{"match_all": {"boost": 1}}`.
|
|
|
|
`query_delay` (Optional)::
|
|
(time units) The number of seconds behind real time that data is queried. For
|
|
example, if data from 10:04 a.m. might not be searchable in {es} until
|
|
10:06 a.m., set this property to 120 seconds. The default value is `60s`.
|
|
|
|
`script_fields` (Optional)::
|
|
(object) Specifies scripts that evaluate custom expressions and returns
|
|
script fields to the {dfeed}.
|
|
The <<ml-detectorconfig,detector configuration objects>> in a job can contain
|
|
functions that use these script fields. For more information,
|
|
see {ref}/search-request-script-fields.html[Script Fields].
|
|
|
|
`scroll_size` (Optional)::
|
|
(unsigned integer) The `size` parameter that is used in {es} searches.
|
|
The default value is `1000`.
|
|
|
|
For more information about these properties,
|
|
see <<ml-datafeed-resource>>.
|
|
|
|
[[ml-put-datafeed-example]]
|
|
==== {api-examples-title}
|
|
|
|
The following example creates the `datafeed-total-requests` {dfeed}:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
PUT _ml/datafeeds/datafeed-total-requests
|
|
{
|
|
"job_id": "total-requests",
|
|
"indices": ["server-metrics"]
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[skip:setup:server_metrics_job]
|
|
|
|
When the {dfeed} is created, you receive the following results:
|
|
[source,js]
|
|
----
|
|
{
|
|
"datafeed_id": "datafeed-total-requests",
|
|
"job_id": "total-requests",
|
|
"query_delay": "83474ms",
|
|
"indices": [
|
|
"server-metrics"
|
|
],
|
|
"query": {
|
|
"match_all": {
|
|
"boost": 1.0
|
|
}
|
|
},
|
|
"scroll_size": 1000,
|
|
"chunking_config": {
|
|
"mode": "auto"
|
|
}
|
|
}
|
|
----
|
|
// TESTRESPONSE[s/"query_delay": "83474ms"/"query_delay": $body.query_delay/]
|
|
// TESTRESPONSE[s/"query.boost": "1.0"/"query.boost": $body.query.boost/]
|