Update a datafeed Generally available; Added in 6.4.0

POST /_ml/datafeeds/{datafeed_id}/_update
Api key auth Basic auth Bearer auth

You must stop and start the datafeed for the changes to be applied. When Elasticsearch security features are enabled, your datafeed remembers which roles the user who updated it had at the time of the update and runs the query using those same roles. If you provide secondary authorization headers, those credentials are used instead.

highlight#highlightFromAnchor" href="#topic-required-authorization"> Required authorization

  • Cluster privileges: manage_ml

Path parameters

  • datafeed_id string Required

    A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.

Query parameters

  • allow_no_indices boolean

    If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the _all string or when no indices are specified.

  • expand_wildcards string | array[string]

    Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.

    Supported values include:

    • all: Match any data stream or index, including hidden ones.
    • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
    • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
    • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
    • none: Wildcard expressions are not accepted.

    Values are all, open, closed, hidden, or none.

  • ignore_throttled boolean Deprecated

    If true, concrete, expanded or aliased indices are ignored when frozen.

  • ignore_unavailable boolean

    If true, unavailable indices (missing or closed) are ignored.

application/json

Body Required

Responses

  • 200 application/json
    details#setActive"> Hide response attributes Show response attributes object
    • authorization object
      details#setActive"> Hide authorization attributes Show authorization attributes object
      • api_key object
        details#setActive"> Hide api_key attributes Show api_key attributes object
        • id string Required

          The identifier for the API key.

        • name string Required

          The name of the API key.

      • roles array[string]

        If a user ID was used for the most recent update to the datafeed, its roles at the time of the update are listed in the response.

      • service_account string

        If a service account was used for the most recent update to the datafeed, the account name is listed in the response.

    • aggregations object
    • chunking_config object Required
      details#setActive"> Hide chunking_config attributes Show chunking_config attributes object
      • mode string Required

        Values are auto, manual, or off.

      • time_span string

        A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

    • delayed_data_check_config object
      details#setActive"> Hide delayed_data_check_config attributes Show delayed_data_check_config attributes object
      • check_window string

        A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

      • enabled boolean Required

        Specifies whether the datafeed periodically checks for delayed data.

    • datafeed_id string Required
    • frequency string

      A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

    • indices array[string] Required
    • indices_options object

      Controls how to deal with unavailable concrete indices (closed or missing), how wildcard expressions are expanded to actual indices (all, closed or open indices) and how to deal with wildcard expressions that resolve to no indices.

      details#setActive"> Hide indices_options attributes Show indices_options attributes object
      • allow_no_indices boolean

        If false, the request returns an error if any wildcard expression, index alias, or _all value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting foo*,bar* returns an error if an index starts with foo but no index starts with bar.

      • expand_wildcards string | array[string]
      • ignore_unavailable boolean

        If true, missing or closed indices are not included in the response.

        Default value is false.

      • ignore_throttled boolean

        If true, concrete, expanded or aliased indices are ignored when frozen.

        Default value is true.

    • job_id string Required
    • max_empty_searches number
    • query object Required

      An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

      External documentation
    • query_delay string Required

      A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

    • runtime_mappings object
      details#setActive"> Hide runtime_mappings attribute Show runtime_mappings attribute object
      • * object Additional properties
        details#setActive"> Hide * attributes Show * attributes object
        • fields object

          For type composite

          details#setActive"> Hide fields attribute Show fields attribute object
          • * object Additional properties
            details#setActive"> Hide * attribute Show * attribute object
            • type string Required

              Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.

        • fetch_fields array[object]

          For type lookup

          details#setActive"> Hide fetch_fields attributes Show fetch_fields attributes object
          • field string Required

            Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

          • format string
        • format string

          A custom format for date type runtime fields.

        • input_field string

          Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

        • target_field string

          Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

        • target_index string
        • script object
          details#setActive"> Hide script attributes Show script attributes object
        • type string Required

          Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.

    • script_fields object
      details#setActive"> Hide script_fields attribute Show script_fields attribute object
    • scroll_size number Required
POST /_ml/datafeeds/{datafeed_id}/_update
dropdown#toggle click@window->dropdown#hide touchend@window->dropdown#hide" data-dropdown-target="button" data-scrollable="false" data-headings="false" aria-expanded="false" aria-haspopup="true" role="menu" tabindex="0">
Console 
POST _ml/datafeeds/datafeed-test-job/_update
{
  "query": {
    "term": {
      "geo.src": "US"
    }
  }
}
resp = client.ml.update_datafeed(
    datafeed_id="datafeed-test-job",
    query={
        "term": {
            "geo.src": "US"
        }
    },
)
const response = await client.ml.updateDatafeed({
  datafeed_id: "datafeed-test-job",
  query: {
    term: {
      "geo.src": "US",
    },
  },
});
response = client.ml.update_datafeed(
  datafeed_id: "datafeed-test-job",
  body: {
    "query": {
      "term": {
        "geo.src": "US"
      }
    }
  }
)
$resp = $client->ml()->updateDatafeed([
    "datafeed_id" => "datafeed-test-job",
    "body" => [
        "query" => [
            "term" => [
                "geo.src" => "US",
            ],
        ],
    ],
]);
curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"query":{"term":{"geo.src":"US"}}}' "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-test-job/_update"
client.ml().updateDatafeed(u -> u
    .datafeedId("datafeed-test-job")
    .query(q -> q
        .term(t -> t
            .field("geo.src")
            .value(FieldValue.of("US"))
        )
    )
);
Request example
An example body for a `POST _ml/datafeeds/datafeed-test-job/_update` request. 
{
  "query": {
    "term": {
      "geo.src": "US"
    }
  }
}