elasticsearch/docs/reference/ml/anomaly-detection/apis/start-datafeed.asciidoc

[role="xpack"]
[[ml-start-datafeed]]
= Start {dfeeds} API

[subs="attributes"]
++++
<titleabbrev>Start {dfeeds}</titleabbrev>
++++

Starts one or more {dfeeds}.

[[ml-start-datafeed-request]]
== {api-request-title}

`POST _ml/datafeeds/<feed_id>/_start`

[[ml-start-datafeed-prereqs]]
== {api-prereq-title}

* Before you can start a {dfeed}, the {anomaly-job} must be open. Otherwise, an
error occurs.
* Requires the `manage_ml` cluster privilege. This privilege is included in the 
`machine_learning_admin` built-in role.

[[ml-start-datafeed-desc]]
== {api-description-title}

A {dfeed} must be started in order to retrieve data from {es}.
A {dfeed} can be started and stopped multiple times throughout its lifecycle.

If you restart a stopped {dfeed}, by default it continues processing input data
from the next millisecond after it was stopped. If new data was indexed for that
exact millisecond between stopping and starting, it will be ignored.

IMPORTANT: When {es} {security-features} are enabled, your {dfeed} remembers
which roles the last user to create or update it had at the time of
creation/update and runs the query using those same roles. If you provided
<<http-clients-secondary-authorization,secondary authorization headers>> when
you created or updated the {dfeed}, those credentials are used instead.

[[ml-start-datafeed-path-parms]]
== {api-path-parms-title}

`<feed_id>`::
(Required, string)
include::{es-repo-dir}/ml/ml-shared.asciidoc[tag=datafeed-id]

[[ml-start-datafeed-query-parms]]
== {api-query-parms-title}

`end`::
(Optional, string) The time that the {dfeed} should end, which can be
specified by using one of the following formats:
+
--
* ISO 8601 format with milliseconds, for example `2017-01-22T06:00:00.000Z`
* ISO 8601 format without milliseconds, for example `2017-01-22T06:00:00+00:00`
* Milliseconds since the epoch, for example `1485061200000`
 
Date-time arguments using either of the ISO 8601 formats must have a time zone
designator, where `Z` is accepted as an abbreviation for UTC time.
  
NOTE: When a URL is expected (for example, in browsers), the `+` used in time
zone designators must be encoded as `%2B`.
  
This value is exclusive. If you do not specify an end time, the {dfeed} runs
continuously.
--

`start`::
(Optional, string) The time that the {dfeed} should begin, which can be
specified by using the same formats as the `end` parameter. This value is
inclusive.
+
If you do not specify a start time and the {dfeed} is associated with a new
{anomaly-job}, the analysis starts from the earliest time for which data is
available.
+
If you restart a stopped {dfeed} and specify a `start` value that is earlier
than the timestamp of the latest processed record, the {dfeed} continues from
1 millisecond after the timestamp of the latest processed record.

`timeout`::
(Optional, time) Specifies the amount of time to wait until a {dfeed} starts.
The default value is 20 seconds.

[[ml-start-datafeed-request-body]]
== {api-request-body-title}

You can also specify the query parameters (such as `end` and `start`)
in the request body.

[[ml-start-datafeed-response-body]]
== {api-response-body-title}

`node`::
  (string) The ID of the node that the {dfeed} was started on. If the {dfeed} is
  allowed to open lazily and has not yet been assigned to a node, this value is
  an empty string.

`started`::
  (Boolean) For a successful response, this value is always `true`. On failure, an
  exception is returned instead.

[[ml-start-datafeed-example]]
== {api-examples-title}

[source,console]
--------------------------------------------------
POST _ml/datafeeds/datafeed-low_request_rate/_start
{
  "start": "2019-04-07T18:22:16Z"
}
--------------------------------------------------
// TEST[skip:Kibana sample data]

When the {dfeed} starts, you receive the following results:

[source,console-result]
----
{
  "started" : true,
  "node" : "node-1"
}
----