elasticsearch/docs/reference/ml/anomaly-detection/apis/put-datafeed.asciidoc

[role="xpack"]
[testenv="platinum"]
[[ml-put-datafeed]]
=== Create {dfeeds} API

[subs="attributes"]
++++
<titleabbrev>Create {dfeeds}</titleabbrev>
++++

Instantiates a {dfeed}.

[[ml-put-datafeed-request]]
==== {api-request-title}

`PUT _ml/datafeeds/<feed_id>`

[[ml-put-datafeed-prereqs]]
==== {api-prereq-title}

* You must create an {anomaly-job} before you create a {dfeed}.  
* If {es} {security-features} are enabled, you must have `manage_ml` or `manage`
cluster privileges to use this API. See
{stack-ov}/security-privileges.html[Security privileges].

[[ml-put-datafeed-desc]]
==== {api-description-title}

You can associate only one {dfeed} to each {anomaly-job}.

[IMPORTANT]
====
* You must use {kib} or this API to create a {dfeed}. Do not put a
{dfeed} directly to the `.ml-config` index using the {es} index API. If {es}
{security-features} are enabled, do not give users `write` privileges on the
`.ml-config` index.
* When {es} {security-features} are enabled, your {dfeed} remembers which roles
the user who created it had at the time of creation and runs the query using
those same roles.
====

[[ml-put-datafeed-path-parms]]
==== {api-path-parms-title}

`<feed_id>`::
  (Required, string) A numerical character string that uniquely identifies the
  {dfeed}. This identifier can contain lowercase alphanumeric characters (a-z
  and 0-9), hyphens, and underscores. It must start and end with alphanumeric
  characters.

[[ml-put-datafeed-request-body]]
==== {api-request-body-title}

`aggregations`::
  (Optional, object) If set, the {dfeed} performs aggregation searches. For more
  information, see <<ml-datafeed-resource>>.

`chunking_config`::
  (Optional, object) Specifies how data searches are split into time chunks. See
  <<ml-datafeed-chunking-config>>.

`delayed_data_check_config`::
  (Optional, object) Specifies whether the data feed checks for missing data and 
  the size of the window. See <<ml-datafeed-delayed-data-check-config>>.

`frequency`::
  (Optional, <<time-units, time units>>) The interval at which scheduled queries 
  are made while the {dfeed} runs in real time. The default value is either the 
  bucket span for short bucket spans, or, for longer bucket spans, a sensible 
  fraction of the bucket span. For example: `150s`.

`indices`::
  (Required, array) An array of index names. Wildcards are supported. For
  example: `["it_ops_metrics", "server*"]`.
+
--
NOTE: If any indices are in remote clusters then `cluster.remote.connect` must
not be set to `false` on any ML node.
--

`job_id`::
 (Required, string) A numerical character string that uniquely identifies the
 {anomaly-job}.

`query`::
  (Optional, object) The {es} query domain-specific language (DSL). This value
  corresponds to the query object in an {es} search POST body. All the options
  that are supported by {Es} can be used, as this object is passed verbatim to
  {es}. By default, this property has the following value:
  `{"match_all": {"boost": 1}}`.

`query_delay`::
  (Optional, <<time-units, time units>>) The number of seconds behind real time 
  that data is queried. For example, if data from 10:04 a.m. might not be 
  searchable in {es} until 10:06 a.m., set this property to 120 seconds. The 
  default value is `60s`.

`script_fields`::
  (Optional, object) Specifies scripts that evaluate custom expressions and
  returns script fields to the {dfeed}. The
  <<ml-detectorconfig,detector configuration objects>> in a job can contain
  functions that use these script fields. For more information, see
  <<request-body-search-script-fields,Script fields>>.

`scroll_size`::
  (Optional, unsigned integer) The `size` parameter that is used in {es}
  searches. The default value is `1000`.

For more information about these properties,
see <<ml-datafeed-resource>>.

[[ml-put-datafeed-example]]
==== {api-examples-title}

The following example creates the `datafeed-total-requests` {dfeed}:

[source,console]
--------------------------------------------------
PUT _ml/datafeeds/datafeed-total-requests
{
  "job_id": "total-requests",
  "indices": ["server-metrics"]
}
--------------------------------------------------
// TEST[skip:setup:server_metrics_job]

When the {dfeed} is created, you receive the following results:

[source,console-result]
----
{
  "datafeed_id": "datafeed-total-requests",
  "job_id": "total-requests",
  "query_delay": "83474ms",
  "indices": [
    "server-metrics"
  ],
  "query": {
    "match_all": {
      "boost": 1.0
    }
  },
  "scroll_size": 1000,
  "chunking_config": {
    "mode": "auto"
  }
}
----
// TESTRESPONSE[s/"query_delay": "83474ms"/"query_delay": $body.query_delay/]
// TESTRESPONSE[s/"query.boost": "1.0"/"query.boost": $body.query.boost/]