Path parameters

• datafeed_id string | array[string] Required

  Identifier for the datafeed. It can be a datafeed identifier or a wildcard expression. If you do not specify one of these options, the API returns information about all datafeeds.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  1. Contains wildcard expressions and there are no datafeeds that match.
  2. Contains the _all string or no identifiers and there are no matches.
  3. Contains wildcard expressions and there are only partial matches.

  The default value is true, which returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If this parameter is false, the request returns a 404 status code when there are no matches or only partial matches.

• exclude_generated boolean

  Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • count number Required
  • datafeeds array[object] Required
    Hide datafeeds attributes Show datafeeds attributes object

    • aggregations object
    • authorization object

      The security privileges that the datafeed uses to run its queries. If Elastic Stack security features were disabled at the time of the most recent update to the datafeed, this property is omitted.

      Hide authorization attributes Show authorization attributes object

      • roles array[string]

        If a user ID was used for the most recent update to the datafeed, its roles at the time of the update are listed in the response.

      • service_account string

        If a service account was used for the most recent update to the datafeed, the account name is listed in the response.

    • chunking_config object
    • datafeed_id string Required
    • frequency string

      The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: 150s. When frequency is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.

      External documentation
    • indices array[string] Required
    • indexes array[string]
    • job_id string Required
    • max_empty_searches number
    • query_delay string

      A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

      External documentation
    • script_fields object
      Hide script_fields attribute Show script_fields attribute object

      • * object Additional properties
        Hide * attributes Show * attributes object

        • script
        • ignore_failure boolean
    • scroll_size number
    • delayed_data_check_config object Required
      Hide delayed_data_check_config attribute Show delayed_data_check_config attribute object

      • enabled boolean Required

        Specifies whether the datafeed periodically checks for delayed data.

    • runtime_mappings object
      Hide runtime_mappings attribute Show runtime_mappings attribute object

      • * object Additional properties
    • indices_options object

      Controls how to deal with unavailable concrete indices (closed or missing), how wildcard expressions are expanded to actual indices (all, closed or open indices) and how to deal with wildcard expressions that resolve to no indices.

      Hide indices_options attributes Show indices_options attributes object

      • allow_no_indices boolean

        A setting that does two separate checks on the index expression. If false, the request returns an error (1) if any wildcard expression (including _all and *) resolves to zero matching indices or (2) if the complete set of resolved indices, aliases or data streams is empty after all expressions are evaluated. If true, index expressions that resolve to no indices are allowed and the request returns an empty result.

      • ignore_unavailable boolean

        If false, the request returns an error if it targets a concrete (non-wildcarded) index, alias, or data stream that is missing, closed, or otherwise unavailable. If true, unavailable concrete targets are silently ignored.

        Default value is false.

      • ignore_throttled boolean

        If true, concrete, expanded or aliased indices are ignored when frozen.

        Default value is true.

    • query object Required

      The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default, this property has the following value: {"match_all": {"boost": 1}}.

      Query DSL