OpenSearch/docs/reference/ml/anomaly-detection/apis/update-datafeed.asciidoc
Benjamin Trent eac38e9847
[ML] Add indices_options to datafeed config and update (#52793) (#52905)
This adds a new configurable field called `indices_options`. This allows users to create or update the indices_options used when a datafeed reads from an index.

This is necessary for the following use cases:
 - Reading from frozen indices
 - Allowing certain indices in multiple index patterns to not exist yet

These index options are available on datafeed creation and update. Users may specify them as URL parameters or within the configuration object.

closes https://github.com/elastic/elasticsearch/issues/48056
2020-02-27 13:43:25 -05:00

150 lines
3.5 KiB
Plaintext

[role="xpack"]
[testenv="platinum"]
[[ml-update-datafeed]]
=== Update {dfeeds} API
[subs="attributes"]
++++
<titleabbrev>Update {dfeeds}</titleabbrev>
++++
Updates certain properties of a {dfeed}.
[[ml-update-datafeed-request]]
==== {api-request-title}
`POST _ml/datafeeds/<feed_id>/_update`
[[ml-update-datafeed-prereqs]]
==== {api-prereq-title}
* If {es} {security-features} are enabled, you must have `manage_ml`, or `manage`
cluster privileges to use this API. See
<<security-privileges>>.
[[ml-update-datafeed-desc]]
==== {api-description-title}
If you update a {dfeed} property, you must stop and start the {dfeed} for the
change to be applied.
IMPORTANT: When {es} {security-features} are enabled, your {dfeed} remembers
which roles the user who updated it had at the time of update and runs the query
using those same roles.
[[ml-update-datafeed-path-parms]]
==== {api-path-parms-title}
`<feed_id>`::
(Required, string)
include::{docdir}/ml/ml-shared.asciidoc[tag=datafeed-id]
[[ml-update-datafeed-request-body]]
==== {api-request-body-title}
The following properties can be updated after the {dfeed} is created:
`aggregations`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=aggregations]
`chunking_config`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=chunking-config]
`delayed_data_check_config`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=delayed-data-check-config]
`frequency`::
(Optional, <<time-units, time units>>)
include::{docdir}/ml/ml-shared.asciidoc[tag=frequency]
`indices`::
(Optional, array)
include::{docdir}/ml/ml-shared.asciidoc[tag=indices]
`max_empty_searches`::
(Optional, integer)
include::{docdir}/ml/ml-shared.asciidoc[tag=max-empty-searches]
+
--
The special value `-1` unsets this setting.
--
`query`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=query]
+
--
WARNING: If you change the query, the analyzed data is also changed. Therefore,
the required time to learn might be long and the understandability of the
results is unpredictable. If you want to make significant changes to the source
data, we would recommend you clone it and create a second job containing the
amendments. Let both run in parallel and close one when you are satisfied with
the results of the other job.
--
`query_delay`::
(Optional, <<time-units, time units>>)
include::{docdir}/ml/ml-shared.asciidoc[tag=query-delay]
`script_fields`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=script-fields]
`scroll_size`::
(Optional, unsigned integer)
include::{docdir}/ml/ml-shared.asciidoc[tag=scroll-size]
`indices_options`::
(Optional, object)
include::{docdir}/ml/ml-shared.asciidoc[tag=indices-options]
[[ml-update-datafeed-example]]
==== {api-examples-title}
[source,console]
--------------------------------------------------
POST _ml/datafeeds/datafeed-total-requests/_update
{
"query": {
"term": {
"level": "error"
}
}
}
--------------------------------------------------
// TEST[skip:setup:server_metrics_datafeed]
When the {dfeed} is updated, you receive the full {dfeed} configuration with
with the updated values:
[source,console-result]
----
{
"datafeed_id": "datafeed-total-requests",
"job_id": "total-requests",
"query_delay": "83474ms",
"indices": ["server-metrics"],
"query": {
"term": {
"level": {
"value": "error",
"boost": 1.0
}
}
},
"scroll_size": 1000,
"chunking_config": {
"mode": "auto"
}
}
----
// TESTRESPONSE[s/"query.boost": "1.0"/"query.boost": $body.query.boost/]