Browse Source

[DOCS] Update manual downsampling documentation to use TSDS (#97976)

* [DOCS] Update manual downsampling documentation to use TSDS

* Swap manual and ILM downsampling examples in nav

* Typo

* Update prerequisites based on review feedback

* Warn against deleting the old backing index.

* Clarify counter/gauge results

* Mention that the downsampled type is 'aggregate_metric_double'
Abdon Pijpelink 2 years ago
parent
commit
91d0e11ab9

+ 435 - 308
docs/reference/data-streams/downsampling-manual.asciidoc

@@ -4,10 +4,22 @@
 <titleabbrev>Run downsampling manually</titleabbrev>
 ++++
 
-This is a simplified example that allows you to see quickly how
-<<downsampling,downsampling>> works to reduce the storage size of a time series
-index. The example uses typical Kubernetes cluster monitoring data. To test out
-downsampling, follow these steps:
+////
+[source,console]
+----
+DELETE _data_stream/my-data-stream
+DELETE _index_template/my-data-stream-template
+DELETE _ingest/pipeline/my-timestamp-pipeline
+----
+// TEARDOWN
+////
+
+The recommended way to downsample a time series data stream (TSDS) is
+<<downsampling-ilm,through index lifecycle management (ILM)>>. However, if
+you're not using ILM, you can downsample a TSDS manually. This guide shows you
+how, using typical Kubernetes cluster monitoring data. 
+
+To test out manual downsampling, follow these steps:
 
 . Check the <<downsampling-manual-prereqs,prerequisites>>.
 . <<downsampling-manual-create-index>>.
@@ -19,28 +31,25 @@ downsampling, follow these steps:
 [[downsampling-manual-prereqs]]
 ==== Prerequisites
 
-Refer to <<tsds-prereqs,time series data stream prerequisites>>.
-
-For the example you need a sample data file. Download the file from link:
-https://static-www.elastic.co/v3/assets/bltefdd0b53724fa2ce/bltf2fe7a300c3c59f7/631b4bc5cc56115de2f58e8c/sample-k8s-metrics.json[here]
-and save it in the local directory where you're running {es}.
+* Refer to the <<tsds-prereqs,TSDS prerequisites>>.
+* It is not possible to downsample a data stream directly, nor 
+multiple indices at once. It's only possible to downsample one time series index
+(TSDS backing index).
+* In order to downsample an index, it needs to be read-only. For a TSDS write
+index, this means it needs to be rolled over and made read-only first.
+* Downsampling uses UTC timestamps.
+* Downsampling needs at least one metric field to exist in the time series 
+index.
 
 [discrete]
 [[downsampling-manual-create-index]]
-==== Create a time series index
+==== Create a time series data stream
 
-This creates an index for a basic data stream. The available parameters for an
-index are described in detail in <<set-up-a-data-stream,Set up a time series
-data stream>>.
-
-The time series boundaries are set so that sampling data for the index begins at
-`2022-06-10T00:00:00Z` and ends at `2022-06-30T23:59:59Z`.
-
-For simplicity, in the time series mapping all `time_series_metric` parameters
-are set to type `gauge`, but <<time-series-metric,other values>> such as
-`counter` and `histogram` may also be used. The `time_series_metric` values
-determine the kind of statistical representations that are used during
-downsampling.
+First, you'll create a TSDS. For simplicity, in the time series mapping all
+`time_series_metric` parameters are set to type `gauge`, but
+<<time-series-metric,other values>> such as `counter` and `histogram` may also
+be used. The `time_series_metric` values determine the kind of statistical
+representations that are used during downsampling.
 
 The index template includes a set of static 
 <<time-series-dimension,time series dimensions>>: `host`, `namespace`, 
@@ -49,258 +58,241 @@ downsampling process.
 
 [source,console]
 ----
-PUT /sample-01
+PUT _index_template/my-data-stream-template
 {
+  "index_patterns": [
+    "my-data-stream*"
+  ],
+  "data_stream": {},
+  "template": {
     "settings": {
-        "index": {
-            "mode": "time_series",
-            "time_series": {
-                "start_time": "2022-06-10T00:00:00Z",
-                "end_time": "2022-06-30T23:59:59Z"
-            },
-            "routing_path": [
-                "kubernetes.namespace",
-                "kubernetes.host",
-                "kubernetes.node",
-                "kubernetes.pod"
-            ],
-            "number_of_replicas": 0,
-            "number_of_shards": 2
-        }
+      "index": {
+        "mode": "time_series",
+        "routing_path": [
+          "kubernetes.namespace",
+          "kubernetes.host",
+          "kubernetes.node",
+          "kubernetes.pod"
+        ],
+        "number_of_replicas": 0,
+        "number_of_shards": 2
+      }
     },
     "mappings": {
-        "properties": {
-            "@timestamp": {
-                "type": "date"
-            },
-            "kubernetes": {
-                "properties": {
-                    "container": {
-                        "properties": {
-                            "cpu": {
-                                "properties": {
-                                    "usage": {
-                                        "properties": {
-                                            "core": {
-                                                "properties": {
-                                                    "ns": {
-                                                        "type": "long"
-                                                    }
-                                                }
-                                            },
-                                            "limit": {
-                                                "properties": {
-                                                    "pct": {
-                                                        "type": "float"
-                                                    }
-                                                }
-                                            },
-                                            "nanocores": {
-                                                "type": "long",
-                                                "time_series_metric": "gauge"
-                                            },
-                                            "node": {
-                                                "properties": {
-                                                    "pct": {
-                                                        "type": "float"
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    }
-                                }
-                            },
-                            "memory": {
-                                "properties": {
-                                    "available": {
-                                        "properties": {
-                                            "bytes": {
-                                                "type": "long",
-                                                "time_series_metric": "gauge"
-                                            }
-                                        }
-                                    },
-                                    "majorpagefaults": {
-                                        "type": "long"
-                                    },
-                                    "pagefaults": {
-                                        "type": "long",
-                                        "time_series_metric": "gauge"
-                                    },
-                                    "rss": {
-                                        "properties": {
-                                            "bytes": {
-                                                "type": "long",
-                                                "time_series_metric": "gauge"
-                                            }
-                                        }
-                                    },
-                                    "usage": {
-                                        "properties": {
-                                            "bytes": {
-                                                "type": "long",
-                                                "time_series_metric": "gauge"
-                                            },
-                                            "limit": {
-                                                "properties": {
-                                                    "pct": {
-                                                        "type": "float"
-                                                    }
-                                                }
-                                            },
-                                            "node": {
-                                                "properties": {
-                                                    "pct": {
-                                                        "type": "float"
-                                                    }
-                                                }
-                                            }
-                                        }
-                                    },
-                                    "workingset": {
-                                        "properties": {
-                                            "bytes": {
-                                                "type": "long",
-                                                "time_series_metric": "gauge"
-                                            }
-                                        }
-                                    }
-                                }
-                            },
-                            "name": {
-                                "type": "keyword"
-                            },
-                            "start_time": {
-                                "type": "date"
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "kubernetes": {
+          "properties": {
+            "container": {
+              "properties": {
+                "cpu": {
+                  "properties": {
+                    "usage": {
+                      "properties": {
+                        "core": {
+                          "properties": {
+                            "ns": {
+                              "type": "long"
+                            }
+                          }
+                        },
+                        "limit": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
                             }
+                          }
+                        },
+                        "nanocores": {
+                          "type": "long",
+                          "time_series_metric": "gauge"
+                        },
+                        "node": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                },
+                "memory": {
+                  "properties": {
+                    "available": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long",
+                          "time_series_metric": "gauge"
                         }
+                      }
                     },
-                    "host": {
-                        "type": "keyword",
-                        "time_series_dimension": true
+                    "majorpagefaults": {
+                      "type": "long"
                     },
-                    "namespace": {
-                        "type": "keyword",
-                        "time_series_dimension": true
+                    "pagefaults": {
+                      "type": "long",
+                      "time_series_metric": "gauge"
                     },
-                    "node": {
-                        "type": "keyword",
-                        "time_series_dimension": true
+                    "rss": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long",
+                          "time_series_metric": "gauge"
+                        }
+                      }
                     },
-                    "pod": {
-                        "type": "keyword",
-                        "time_series_dimension": true
+                    "usage": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long",
+                          "time_series_metric": "gauge"
+                        },
+                        "limit": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        },
+                        "node": {
+                          "properties": {
+                            "pct": {
+                              "type": "float"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "workingset": {
+                      "properties": {
+                        "bytes": {
+                          "type": "long",
+                          "time_series_metric": "gauge"
+                        }
+                      }
                     }
+                  }
+                },
+                "name": {
+                  "type": "keyword"
+                },
+                "start_time": {
+                  "type": "date"
                 }
+              }
+            },
+            "host": {
+              "type": "keyword",
+              "time_series_dimension": true
+            },
+            "namespace": {
+              "type": "keyword",
+              "time_series_dimension": true
+            },
+            "node": {
+              "type": "keyword",
+              "time_series_dimension": true
+            },
+            "pod": {
+              "type": "keyword",
+              "time_series_dimension": true
             }
+          }
         }
+      }
     }
+  }
 }
-
 ----
 
 [discrete]
 [[downsampling-manual-ingest-data]]
 ==== Ingest time series data
 
-In a terminal window with {es} running, run the following curl command to load
-the documents from the downloaded sample data file:
+Because time series data streams have been designed to
+<<tsds-accepted-time-range,only accept recent data>>, in this example, you'll
+use an ingest pipeline to time-shift the data as it gets indexed. As a result,
+the indexed data will have an `@timestamp` from the last 15 minutes.
+
+Create the pipeline with this request:
 
-[source,sh]
+[source,console]
 ----
-curl -s -H "Content-Type: application/json" \
-   -XPOST http://<elasticsearch-node>/sample-01/_bulk?pretty \
-   --data-binary @sample-k8s-metrics.json
+PUT _ingest/pipeline/my-timestamp-pipeline
+{
+  "description": "Shifts the @timestamp to the last 15 minutes",
+  "processors": [
+    {
+      "set": {
+        "field": "ingest_time",
+        "value": "{{_ingest.timestamp}}"
+      }
+    },
+    {
+      "script": {
+        "lang": "painless",
+        "source": """
+          def delta = ChronoUnit.SECONDS.between(
+            ZonedDateTime.parse("2022-06-21T15:49:00Z"),
+            ZonedDateTime.parse(ctx["ingest_time"])
+          );
+          ctx["@timestamp"] = ZonedDateTime.parse(ctx["@timestamp"]).plus(delta,ChronoUnit.SECONDS).toString();
+        """
+      }
+    }
+  ]
+}
 ----
-// NOTCONSOLE
+// TEST[continued]
 
-Approximately 18,000 documents are added. Check the search results for the newly
-ingested data:
+Next, use a bulk API request to automatically create your TSDS and index a set
+of ten documents:
 
 [source,console]
 ----
-GET /sample-01*/_search
+PUT /my-data-stream/_bulk?refresh&pipeline=my-timestamp-pipeline
+{"create": {}}
+{"@timestamp":"2022-06-21T15:49:00Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":91153,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":463314616},"usage":{"bytes":307007078,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":585236},"rss":{"bytes":102728},"pagefaults":120901,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:45:50Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":124501,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":982546514},"usage":{"bytes":360035574,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":1339884},"rss":{"bytes":381174},"pagefaults":178473,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:44:50Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":38907,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":862723768},"usage":{"bytes":379572388,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":431227},"rss":{"bytes":386580},"pagefaults":233166,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:44:40Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":86706,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":567160996},"usage":{"bytes":103266017,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":1724908},"rss":{"bytes":105431},"pagefaults":233166,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:44:00Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":150069,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":639054643},"usage":{"bytes":265142477,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":1786511},"rss":{"bytes":189235},"pagefaults":138172,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:42:40Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":82260,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":854735585},"usage":{"bytes":309798052,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":924058},"rss":{"bytes":110838},"pagefaults":259073,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:42:10Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":153404,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":279586406},"usage":{"bytes":214904955,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":1047265},"rss":{"bytes":91914},"pagefaults":302252,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:40:20Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":125613,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":822782853},"usage":{"bytes":100475044,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":2109932},"rss":{"bytes":278446},"pagefaults":74843,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:40:10Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":100046,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":567160996},"usage":{"bytes":362826547,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":1986724},"rss":{"bytes":402801},"pagefaults":296495,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
+{"create": {}}
+{"@timestamp":"2022-06-21T15:38:30Z","kubernetes":{"host":"gke-apps-0","node":"gke-apps-0-0","pod":"gke-apps-0-0-0","container":{"cpu":{"usage":{"nanocores":40018,"core":{"ns":12828317850},"node":{"pct":2.77905e-05},"limit":{"pct":2.77905e-05}}},"memory":{"available":{"bytes":1062428344},"usage":{"bytes":265142477,"node":{"pct":0.01770037710617187},"limit":{"pct":9.923134671484496e-05}},"workingset":{"bytes":2294743},"rss":{"bytes":340623},"pagefaults":224530,"majorpagefaults":0},"start_time":"2021-03-30T07:59:06Z","name":"container-name-44"},"namespace":"namespace26"}}
 ----
 // TEST[continued]
 
-The query has at least 10,000 hits and returns the first 10. In each document
-you can see the time series dimensions (`host`, `node`, `pod` and `container`)
-as well as the various CPU and memory time series metrics.
+You can use the search API to check if the documents have been indexed
+correctly:
 
-[source,console-result]
+[source,console]
 ----
-  "hits": {
-    "total": {
-      "value": 10000,
-      "relation": "gte"
-    },
-    "max_score": 1,
-    "hits": [
-      {
-        "_index": "sample-01",
-        "_id": "WyHN6N6AwdaJByQWAAABgYOOweA",
-        "_score": 1,
-        "_source": {
-          "@timestamp": "2022-06-20T23:59:40Z",
-          "kubernetes": {
-            "host": "gke-apps-0",
-            "node": "gke-apps-0-1",
-            "pod": "gke-apps-0-1-0",
-            "container": {
-              "cpu": {
-                "usage": {
-                  "nanocores": 80037,
-                  "core": {
-                    "ns": 12828317850
-                  },
-                  "node": {
-                    "pct": 0.0000277905
-                  },
-                  "limit": {
-                    "pct": 0.0000277905
-                  }
-                }
-              },
-              "memory": {
-                "available": {
-                  "bytes": 790830121
-                },
-                "usage": {
-                  "bytes": 139548672,
-                  "node": {
-                    "pct": 0.01770037710617187
-                  },
-                  "limit": {
-                    "pct": 0.00009923134671484496
-                  }
-                },
-                "workingset": {
-                  "bytes": 2248540
-                },
-                "rss": {
-                  "bytes": 289260
-                },
-                "pagefaults": 74843,
-                "majorpagefaults": 0
-              },
-              "start_time": "2021-03-30T07:59:06Z",
-              "name": "container-name-44"
-            },
-            "namespace": "namespace26"
-          }
-        }
-      }
-...
+GET /my-data-stream/_search
 ----
-// TEST[skip:todo]
 // TEST[continued]
 
-Next, you can run a terms aggregation on the set of time series dimensions (`_tsid`) to
-view a date histogram on a fixed interval of one day.
+Run the following aggregation on the data to calculate some interesting
+statistics:
 
 [source,console]
 ----
-GET /sample-01*/_search
+GET /my-data-stream/_search
 {
     "size": 0,
     "aggs": {
@@ -341,122 +333,257 @@ GET /sample-01*/_search
 
 [discrete]
 [[downsampling-manual-run]]
-==== Run downsampling for the index
+==== Downsample the TSDS
 
-Before running downsampling, the index needs to be set to read only mode:
+A TSDS can't be downsampled directly. You need to downsample its backing indices
+instead. You can see the backing index for your data stream by running:
 
 [source,console]
 ----
-PUT /sample-01/_block/write
+GET /_data_stream/my-data-stream
 ----
 // TEST[continued]
 
-And now, you can use the <<indices-downsample-data-stream,downsample API>> to
-downsample the index, setting the time series interval to one hour:
+This returns:
+
+[source,console-result]
+----
+{
+  "data_streams": [
+    {
+      "name": "my-data-stream",
+      "timestamp_field": {
+        "name": "@timestamp"
+      },
+      "indices": [
+        {
+          "index_name": ".ds-my-data-stream-2023.07.26-000001", <1>
+          "index_uuid": "ltOJGmqgTVm4T-Buoe7Acg"
+        }
+      ],
+      "generation": 1,
+      "status": "GREEN",
+      "template": "my-data-stream-template",
+      "hidden": false,
+      "system": false,
+      "allow_custom_routing": false,
+      "replicated": false,
+      "time_series": {
+        "temporal_ranges": [
+          {
+            "start": "2023-07-26T09:26:42.000Z",
+            "end": "2023-07-26T13:26:42.000Z"
+          }
+        ]
+      }
+    }
+  ]
+}
+----
+// TESTRESPONSE[s/".ds-my-data-stream-2023.07.26-000001"/$body.data_streams.0.indices.0.index_name/]
+// TESTRESPONSE[s/"ltOJGmqgTVm4T-Buoe7Acg"/$body.data_streams.0.indices.0.index_uuid/]
+// TESTRESPONSE[s/"2023-07-26T09:26:42.000Z"/$body.data_streams.0.time_series.temporal_ranges.0.start/]
+// TESTRESPONSE[s/"2023-07-26T13:26:42.000Z"/$body.data_streams.0.time_series.temporal_ranges.0.end/]
+<1> The backing index for this data stream.
+
+Before a backing index can be downsampled, the TSDS needs to be rolled over and
+the old index needs to be made read-only.
+
+Roll over the TSDS using the <<indices-rollover-index,rollover API>>:
 
 [source,console]
 ----
-POST /sample-01/_downsample/sample-01-downsample
+POST /my-data-stream/_rollover/
+----
+// TEST[continued]
+
+Copy the name of the `old_index` from the response. In the following steps,
+replace the index name with that of your `old_index`.
+
+The old index needs to be set to read-only mode. Run the following request:
+
+[source,console]
+----
+PUT /.ds-my-data-stream-2023.07.26-000001/_block/write
+----
+// TEST[skip:We don't know the index name at test time]
+
+Next, use the <<indices-downsample-data-stream,downsample API>> to downsample
+the index, setting the time series interval to one hour:
+
+[source,console]
+----
+POST /.ds-my-data-stream-2023.07.26-000001/_downsample/.ds-my-data-stream-2023.07.26-000001-downsample
 {
   "fixed_interval": "1h"
 }
 ----
-// TEST[continued]
+// TEST[skip:We don't know the index name at test time]
 
-Finally, delete the original index:
+Now you can <<modify-data-streams-api,modify the data stream>>, and replace the
+original index with the downsampled one:
 
 [source,console]
 ----
-DELETE /sample-01
+POST _data_stream/_modify
+{
+  "actions": [
+    {
+      "remove_backing_index": {
+        "data_stream": "my-data-stream",
+        "index": ".ds-my-data-stream-2023.07.26-000001"
+      }
+    },
+    {
+      "add_backing_index": {
+        "data_stream": "my-data-stream",
+        "index": ".ds-my-data-stream-2023.07.26-000001-downsample"
+      }
+    }
+  ]
+}
 ----
-// TEST[continued]
+// TEST[skip:We don't know the index name at test time]
+
+You can now delete the old backing index. But be aware this will delete the
+original data. Don't delete the index if you may need the original data in the
+future.
 
 [discrete]
 [[downsampling-manual-view-results]]
 ==== View the results
 
-
-Re-run your search query (note that when querying downsampled indices there are <<querying-downsampled-indices-notes,a few nuances to be aware of>>):
+Re-run the earlier search query (note that when querying downsampled indices
+there are <<querying-downsampled-indices-notes,a few nuances to be aware of>>):
 
 [source,console]
 ----
-GET /sample-01*/_search
+GET /my-data-stream/_search
 ----
-// TEST[continued]
+// TEST[skip:Because we've skipped the previous steps]
 
-In the query results, notice that the number of hits has been reduced to only 288
-documents. As well, for each time series metric statistical representations have
-been calculated: `min`, `max`, `sum`, and `value_count`.
+The TSDS with the new downsampled backing index contains just one document. For
+counters, this document would only have the last value. For gauges, the field
+type is now `aggregate_metric_double`. You see the `min`, `max`, `sum`, and
+`value_count` statistics based off of the original sampled metrics:
 
 [source,console-result]
 ----
+{
+  "took": 2,
+  "timed_out": false,
+  "_shards": {
+    "total": 4,
+    "successful": 4,
+    "skipped": 0,
+    "failed": 0
+  },
   "hits": {
     "total": {
-      "value": 288,
+      "value": 1,
       "relation": "eq"
     },
     "max_score": 1,
     "hits": [
       {
-        "_index": "sample-01-downsample",
-        "_id": "WyHN6N6AwdaJByQWAAABgYNYIYA",
+        "_index": ".ds-my-data-stream-2023.07.26-000001-downsample",
+        "_id": "0eL0wC_4-45SnTNFAAABiZHbD4A",
         "_score": 1,
         "_source": {
-          "@timestamp": "2022-06-20T23:00:00.000Z",
-          "_doc_count": 81,
-          "kubernetes.host": "gke-apps-0",
-          "kubernetes.namespace": "namespace26",
-          "kubernetes.node": "gke-apps-0-1",
-          "kubernetes.pod": "gke-apps-0-1-0",
-          "kubernetes.container.cpu.usage.nanocores": {
-            "min": 23344,
-            "max": 163408,
-            "sum": 7488985,
-            "value_count": 81
-          },
-          "kubernetes.container.memory.available.bytes": {
-            "min": 167751844,
-            "max": 1182251090,
-            "sum": 58169948901,
-            "value_count": 81
-          },
-          "kubernetes.container.memory.rss.bytes": {
-            "min": 54067,
-            "max": 391987,
-            "sum": 17550215,
-            "value_count": 81
-          },
-          "kubernetes.container.memory.pagefaults": {
-            "min": 69086,
-            "max": 428910,
-            "sum": 20239365,
-            "value_count": 81
-          },
-          "kubernetes.container.memory.workingset.bytes": {
-            "min": 323420,
-            "max": 2279342,
-            "sum": 104233700,
-            "value_count": 81
-          },
-          "kubernetes.container.memory.usage.bytes": {
-            "min": 61401416,
-            "max": 413064069,
-            "sum": 18557182404,
-            "value_count": 81
+          "@timestamp": "2023-07-26T11:00:00.000Z",
+          "_doc_count": 10,
+          "ingest_time": "2023-07-26T11:26:42.715Z",
+          "kubernetes": {
+            "container": {
+              "cpu": {
+                "usage": {
+                  "core": {
+                    "ns": 12828317850
+                  },
+                  "limit": {
+                    "pct": 0.0000277905
+                  },
+                  "nanocores": {
+                    "min": 38907,
+                    "max": 153404,
+                    "sum": 992677,
+                    "value_count": 10
+                  },
+                  "node": {
+                    "pct": 0.0000277905
+                  }
+                }
+              },
+              "memory": {
+                "available": {
+                  "bytes": {
+                    "min": 279586406,
+                    "max": 1062428344,
+                    "sum": 7101494721,
+                    "value_count": 10
+                  }
+                },
+                "majorpagefaults": 0,
+                "pagefaults": {
+                  "min": 74843,
+                  "max": 302252,
+                  "sum": 2061071,
+                  "value_count": 10
+                },
+                "rss": {
+                  "bytes": {
+                    "min": 91914,
+                    "max": 402801,
+                    "sum": 2389770,
+                    "value_count": 10
+                  }
+                },
+                "usage": {
+                  "bytes": {
+                    "min": 100475044,
+                    "max": 379572388,
+                    "sum": 2668170609,
+                    "value_count": 10
+                  },
+                  "limit": {
+                    "pct": 0.00009923134
+                  },
+                  "node": {
+                    "pct": 0.017700378
+                  }
+                },
+                "workingset": {
+                  "bytes": {
+                    "min": 431227,
+                    "max": 2294743,
+                    "sum": 14230488,
+                    "value_count": 10
+                  }
+                }
+              },
+              "name": "container-name-44",
+              "start_time": "2021-03-30T07:59:06.000Z"
+            },
+            "host": "gke-apps-0",
+            "namespace": "namespace26",
+            "node": "gke-apps-0-0",
+            "pod": "gke-apps-0-0-0"
           }
         }
-      },
-...
+      }
+    ]
+  }
+}
 ----
-// TEST[skip:todo]
+// TEST[skip:Because we've skipped the previous step]
 
-You can now re-run the earlier aggregation. Even though the aggregation runs on
-the downsampled data stream that only contains 288 documents, it returns the
-same results as the earlier aggregation on the original data stream.
+Re-run the earlier aggregation. Even though the aggregation runs on the
+downsampled TSDS that only contains 1 document, it returns the same results as
+the earlier aggregation on the original TSDS.
 
 [source,console]
 ----
-GET /sample-01*/_search
+GET /my-data-stream/_search
 {
     "size": 0,
     "aggs": {
@@ -493,13 +620,13 @@ GET /sample-01*/_search
     }
 }
 ----
-// TEST[continued]
+// TEST[skip:Because we've skipped the previous steps]
 
 This example demonstrates how downsampling can dramatically reduce the number of
-records stored for time series data, within whatever time boundaries you choose.
-It's also possible to perform downsampling on already downsampled data, to
-further reduce storage and associated costs, as the time series data ages and
+documents stored for time series data, within whatever time boundaries you
+choose. It's also possible to perform downsampling on already downsampled data,
+to further reduce storage and associated costs, as the time series data ages and
 the data resolution becomes less critical.
 
-Downsampling is very easily integrated within an ILM policy. To learn more, try
-the <<downsampling-ilm,Run downsampling with ILM>> example.
+The recommended way to downsample a TSDS is with ILM. To learn more, try the
+<<downsampling-ilm,Run downsampling with ILM>> example.

+ 1 - 1
docs/reference/data-streams/tsds.asciidoc

@@ -322,5 +322,5 @@ Now that you know the basics, you're ready to <<set-up-tsds,create a TSDS>> or
 include::set-up-tsds.asciidoc[]
 include::tsds-index-settings.asciidoc[]
 include::downsampling.asciidoc[]
-include::downsampling-manual.asciidoc[]
 include::downsampling-ilm.asciidoc[]
+include::downsampling-manual.asciidoc[]