Body Required

• aggregations object

  If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data.

• chunking_config object
  Hide chunking_config attributes Show chunking_config attributes object

  • mode string Required

    Values are auto, manual, or off.

  • time_span string

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

• delayed_data_check_config object
  Hide delayed_data_check_config attributes Show delayed_data_check_config attributes object

  • check_window string

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

  • enabled boolean Required

    Specifies whether the datafeed periodically checks for delayed data.

• frequency string

  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

• indices array[string]

  An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the remote_cluster_client role.

• indices_options object
  Hide indices_options attributes Show indices_options attributes object

  • allow_no_indices boolean

    If false, the request returns an error if any wildcard expression, index alias, or _all value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting foo*,bar* returns an error if an index starts with foo but no index starts with bar.

  • expand_wildcards string | array[string]
  • ignore_unavailable boolean

    If true, missing or closed indices are not included in the response.

  • ignore_throttled boolean

    If true, concrete, expanded or aliased indices are ignored when frozen.

• job_id string
• max_empty_searches number

  If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after frequency times max_empty_searches of real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. By default, it is not set.

• query object

  An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

  External documentation
• query_delay string

  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

• runtime_mappings object
  Hide runtime_mappings attribute Show runtime_mappings attribute object

  • * object Additional properties
    Hide * attributes Show * attributes object

    • fields object

      For type composite

      Hide fields attribute Show fields attribute object

      • * object Additional properties
        Hide * attribute Show * attribute object

        • type string Required

          Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.

    • fetch_fields array[object]

      For type lookup

      Hide fetch_fields attributes Show fetch_fields attributes object

      • field string Required

        Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

      • format string
    • format string

      A custom format for date type runtime fields.

    • input_field string

      Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

    • target_field string

      Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

    • target_index string
    • script object
      Hide script attributes Show script attributes object

      • source string | object

        One of:

        ScriptSource string SearchRequestBody object

        Hide attributes Show attributes

        • aggregations object

          Defines the aggregations that are run as part of the search request.

          External documentation
        • collapse object
          External documentation
        • explain boolean

          If true, the request returns detailed information about score computation as part of a hit.

        • ext object

          Configuration of search extensions defined by Elasticsearch plugins.

          Hide ext attribute Show ext attribute object

          • * object Additional properties
        • from number

          The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

        • highlight object
        • track_total_hits boolean | number

          Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.

        • indices_boost array[object]

          Boost the _score of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than 1.0 increases the score. A boost value between 0 and 1.0 decreases the score.

          External documentation
        • docvalue_fields array[object]

          An array of wildcard (*) field patterns. The request returns doc values for field names matching these patterns in the hits.fields property of the response.

          External documentation

        • knn object | array[object]

          The approximate kNN search to run.

          One of:

          KnnSearch object array-2 array[object]
        • min_score number

          The minimum _score for matching documents. Documents with a lower _score are not included in search results or results collected by aggregations.

        • post_filter object

          An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

          External documentation
        • profile boolean

          Set to true to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.

        • query object

          An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

          External documentation
        • rescore array[object]
        • retriever object
          Hide retriever attributes Show retriever attributes object

          • standard
          • knn
          • rrf
          • text_similarity_reranker
          • rule
        • script_fields object

          Retrieve a script evaluation (based on different fields) for each hit.

          Hide script_fields attribute Show script_fields attribute object

          • * object Additional properties
        • search_after array[number | string | boolean | null]

          A field value.

        • size number

          The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after property.

        • slice object
          Hide slice attributes Show slice attributes object

          • field string

            Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

          • id string Required
          • max number Required
        • sort array[string | object]

        • _source boolean | object

          Defines how to fetch a source. Fetching can be disabled entirely, or the source can be filtered.

          One of:

          SourceConfig boolean SourceFilter object
        • fields array[object]

          An array of wildcard (*) field patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.
        • suggest object
          Hide suggest attribute Show suggest attribute object

          • text string

            Global suggest text, to avoid repetition when the same text is used in several suggesters

        • terminate_after number

          The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.

          IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.

          If set to 0 (default), the query does not terminate early.

        • timeout string

          The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.

        • track_scores boolean

          If true, calculate and return document scores, even if the scores are not used for sorting.

        • version boolean

          If true, the request returns the document version as part of a hit.

        • seq_no_primary_term boolean

          If true, the request returns sequence number and primary term of the last modification of each hit.

          External documentation
        • stored_fields string | array[string]
        • pit object
          Hide pit attributes Show pit attributes object

          • id string Required
          • keep_alive string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • runtime_mappings object
        • stats array[string]

          The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.

      • id string
      • params object

        Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.

        Hide params attribute Show params attribute object

        • * object Additional properties

      • lang string

        Any of:

        ScriptLanguage string ScriptLanguage string

        Values are painless, expression, mustache, or java.
      • options object
        Hide options attribute Show options attribute object

        • * string Additional properties
    • type string Required

      Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.

• script_fields object

  Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields.

  Hide script_fields attribute Show script_fields attribute object

  • * object Additional properties
    Hide * attributes Show * attributes object

    • script object Required
      Hide script attributes Show script attributes object

      • source string | object

        One of:

        ScriptSource string SearchRequestBody object

        Hide attributes Show attributes

        • aggregations object

          Defines the aggregations that are run as part of the search request.

          External documentation
        • collapse object
          External documentation
        • explain boolean

          If true, the request returns detailed information about score computation as part of a hit.

        • ext object

          Configuration of search extensions defined by Elasticsearch plugins.

          Hide ext attribute Show ext attribute object

          • * object Additional properties
        • from number

          The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after parameter.

        • highlight object
        • track_total_hits boolean | number

          Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.

        • indices_boost array[object]

          Boost the _score of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than 1.0 increases the score. A boost value between 0 and 1.0 decreases the score.

          External documentation
        • docvalue_fields array[object]

          An array of wildcard (*) field patterns. The request returns doc values for field names matching these patterns in the hits.fields property of the response.

          External documentation

        • knn object | array[object]

          The approximate kNN search to run.

          One of:

          KnnSearch object array-2 array[object]
        • min_score number

          The minimum _score for matching documents. Documents with a lower _score are not included in search results or results collected by aggregations.

        • post_filter object

          An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

          External documentation
        • profile boolean

          Set to true to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.

        • query object

          An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.

          External documentation
        • rescore array[object]
        • retriever object
          Hide retriever attributes Show retriever attributes object

          • standard
          • knn
          • rrf
          • text_similarity_reranker
          • rule
        • script_fields object

          Retrieve a script evaluation (based on different fields) for each hit.

          Hide script_fields attribute Show script_fields attribute object

          • * object Additional properties
        • search_after array[number | string | boolean | null]

          A field value.

        • size number

          The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the from and size parameters. To page through more hits, use the search_after property.

        • slice object
          Hide slice attributes Show slice attributes object

          • field string

            Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

          • id string Required
          • max number Required
        • sort array[string | object]

        • _source boolean | object

          Defines how to fetch a source. Fetching can be disabled entirely, or the source can be filtered.

          One of:

          SourceConfig boolean SourceFilter object
        • fields array[object]

          An array of wildcard (*) field patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.
        • suggest object
          Hide suggest attribute Show suggest attribute object

          • text string

            Global suggest text, to avoid repetition when the same text is used in several suggesters

        • terminate_after number

          The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.

          IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.

          If set to 0 (default), the query does not terminate early.

        • timeout string

          The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.

        • track_scores boolean

          If true, calculate and return document scores, even if the scores are not used for sorting.

        • version boolean

          If true, the request returns the document version as part of a hit.

        • seq_no_primary_term boolean

          If true, the request returns sequence number and primary term of the last modification of each hit.

          External documentation
        • stored_fields string | array[string]
        • pit object
          Hide pit attributes Show pit attributes object

          • id string Required
          • keep_alive string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • runtime_mappings object
          Hide runtime_mappings attribute Show runtime_mappings attribute object

          • * object Additional properties
        • stats array[string]

          The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.

      • id string
      • params object

        Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.

        Hide params attribute Show params attribute object

        • * object Additional properties

      • lang string

        Any of:

        ScriptLanguage string ScriptLanguage string

        Values are painless, expression, mustache, or java.
      • options object
        Hide options attribute Show options attribute object

        • * string Additional properties
    • ignore_failure boolean
• scroll_size number

  The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of index.max_result_window.