Creates a transform.
A transform copies data from source indices, transforms it, and persists it into an entity-centric destination index. You can also think of the destination index as a two-dimensional tabular data structure (known as a data frame). The ID for each document in the data frame is generated from a hash of the entity, so there is a unique row per entity.
You must choose either the latest or pivot method for your transform; you cannot use both in a single transform. If
you choose to use the pivot method for your transform, the entities are defined by the set of group_by fields in
the pivot object. If you choose to use the latest method, the entities are defined by the unique_key field values
in the latest object.
You must have create_index, index, and read privileges on the destination index and read and
view_index_metadata privileges on the source indices. When Elasticsearch security features are enabled, the
transform remembers which roles the user that created it had at the time of creation and uses those same roles. If
those roles do not have the required privileges on the source and destination indices, the transform fails when it
attempts unauthorized operations.
NOTE: You must use Kibana or this API to create a transform. Do not add a transform directly into any
.transform-internal* indices using the Elasticsearch index API. If Elasticsearch security features are enabled, do
not give users any privileges on .transform-internal* indices. If you used transforms prior to 7.5, also do not
give users any privileges on .data-frame-internal* indices.
##Required authorization
- Index privileges:
create_index,read,index,view_index_metadata* Cluster privileges:manage_transform
Path parameters
-
Identifier for the transform. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It has a 64 character limit and must start and end with alphanumeric characters.
Query parameters
-
When the transform is created, a series of validations occur to ensure its success. For example, there is a check for the existence of the source indices and a check that the destination index is not part of the source index pattern. You can use this parameter to skip the checks, for example when the source index does not exist until after the transform is created. The validations are always run when you start the transform, however, with the exception of privilege checks.
-
Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
Values are
-1or0.
Body
Required
-
Free text description of the transform.
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Hide pivot attributes Show pivot attributes object
-
Defines how to aggregate the grouped data. The following aggregations are currently supported: average, bucket script, bucket selector, cardinality, filter, geo bounds, geo centroid, geo line, max, median absolute deviation, min, missing, percentiles, rare terms, scripted metric, stats, sum, terms, top metrics, value count, weighted average.
-
Defines how to group the data. More than one grouping can be defined per pivot. The following groupings are currently supported: date histogram, geotile grid, histogram, terms.
Hide group_by attribute Show group_by attribute object
-
Hide * attributes Show * attributes object
-
Hide date_histogram attributes Show date_histogram attributes object
-
Values are
second,1s,minute,1m,hour,1h,day,1d,week,1w,month,1M,quarter,1q,year, or1y. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
The date format used to format
key_as_stringin the response. If noformatis specified, the first date format specified in the field mapping is used. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Only returns buckets that have
min_doc_countnumber of documents. By default, all buckets between the first bucket that matches documents and the last one are returned. -
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Set to
trueto associate a unique string key with each bucket and return the ranges as a hash rather than an array.
-
-
Hide geotile_grid attributes Show geotile_grid attributes object
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Allows for more accurate counting of the top cells returned in the final result the aggregation. Defaults to returning
max(10,(size x number-of-shards))buckets from each shard. -
The maximum number of buckets to return.
-
-
Hide histogram attributes Show histogram attributes object
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The interval for the buckets. Must be a positive decimal.
-
Only returns buckets that have
min_doc_countnumber of documents. By default, the response will fill gaps in the histogram with empty buckets. -
The value to apply to documents that do not have a value. By default, documents without a value are ignored.
-
By default, the bucket keys start with 0 and then continue in even spaced steps of
interval. The bucket boundaries can be shifted by using theoffsetoption. -
If
true, returns buckets as a hash instead of an array, keyed by the bucket keys.
-
Hide terms attributes Show terms attributes object
-
Values are
depth_firstorbreadth_first. -
Values are
map,global_ordinals,global_ordinals_hash, orglobal_ordinals_low_cardinality. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Only return values that are found in more than
min_doc_counthits. -
Values are
first,last, ordefault. -
Coerced unmapped fields into the specified type.
-
Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the
min_doc_count. Terms will only be considered if their local shard frequency within the set is higher than theshard_min_doc_count. -
The number of candidate terms produced by each shard. By default,
shard_sizewill be automatically estimated based on the number of shards and thesizeparameter. -
Set to
trueto return thedoc_count_error_upper_bound, which is an upper bound to the error on thedoc_countreturned by each shard. -
The number of buckets returned out of the overall terms list.
-
-
-
-
-
Hide retention_policy attribute Show retention_policy attribute object
-
Hide time attributes Show time attributes object
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
Hide settings attributes Show settings attributes object
-
Specifies whether the transform checkpoint ranges should be optimized for performance. Such optimization can align checkpoint ranges with the date histogram interval when date histogram is specified as a group source in the transform config. As a result, less document updates in the destination index will be performed thus improving overall performance.
-
Defines if dates in the ouput should be written as ISO formatted string or as millis since epoch. epoch_millis was the default for transforms created before version 7.11. For compatible output set this value to
true. -
Specifies whether the transform should deduce the destination index mappings from the transform configuration.
-
Specifies a limit on the number of input documents per second. This setting throttles the transform by adding a wait time between search requests. The default value is null, which disables throttling.
-
Defines the initial page size to use for the composite aggregation for each checkpoint. If circuit breaker exceptions occur, the page size is dynamically adjusted to a lower value. The minimum value is
10and the maximum is65,536. -
If
true, the transform runs in unattended mode. In unattended mode, the transform retries indefinitely in case of an error which means the transform never fails. Setting the number of retries other than infinite fails in validation.
-
-
Hide source attributes Show source attributes object
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation Hide query attributes Show query attributes object
-
Hide bool attributes Show bool attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
filter
object | array[object] The clause (query) must appear in matching documents. However, unlike
must, the score of the query will be ignored.must
object | array[object] The clause (query) must appear in matching documents and will contribute to the score.
must_not
object | array[object] The clause (query) must not appear in the matching documents. Because scoring is ignored, a score of
0is returned for all documents.should
object | array[object] The clause (query) should appear in the matching document.
-
-
Hide boosting attributes Show boosting attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Floating point number between 0 and 1.0 used to decrease the relevance scores of documents matching the
negativequery. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide combined_fields attributes Show combined_fields attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
List of fields to search. Field wildcard patterns are allowed. Only
textfields are supported, and they must all have the same searchanalyzer. -
Text to search for in the provided
fields. Thecombined_fieldsquery analyzes the provided text before performing a search. -
If true, match phrase queries are automatically created for multi-term synonyms.
-
Values are
ororand. -
Values are
noneorall.
-
-
Hide constant_score attributes Show constant_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide dis_max attributes Show dis_max attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
One or more query clauses. Returned documents must match one or more of these queries. If a document matches multiple queries, Elasticsearch uses the highest relevance score.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses.
-
distance_feature
object One of: Hide attributes Show attributes
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Date or point of origin used to calculate distances. If the
fieldvalue is adateordate_nanosfield, theoriginvalue must be a date. Date Math, such asnow-1h, is supported. If the field value is ageo_pointfield, theoriginvalue must be a geopoint. -
Distance from the
originat which relevance scores receive half of theboostvalue. If thefieldvalue is adateordate_nanosfield, thepivotvalue must be a time unit, such as1hor10d. If thefieldvalue is ageo_pointfield, thepivotvalue must be a distance unit, such as1kmor12m. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Hide attributes Show attributes
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Hide attributes Show attributes
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Hide exists attributes Show exists attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Hide function_score attributes Show function_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
multiply,replace,sum,avg,max, ormin. -
One or more functions that compute a new score for each document returned by the query.
-
Restricts the new score to not exceed the provided limit.
-
Excludes documents that do not meet the provided score threshold.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
multiply,sum,avg,first,max, ormin.
-
-
Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance.
External documentation -
Hide geo_bounding_box attributes Show geo_bounding_box attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
memoryorindexed. -
Values are
coerce,ignore_malformed, orstrict. -
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Hide geo_distance attributes Show geo_distance attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
arcorplane. -
Values are
coerce,ignore_malformed, orstrict. -
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Matches
geo_pointandgeo_shapevalues that intersect a grid cell from a GeoGrid aggregation. -
Hide geo_polygon attributes Show geo_polygon attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Values are
coerce,ignore_malformed, orstrict.
-
-
Hide geo_shape attributes Show geo_shape attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Set to
trueto ignore an unmapped field and not match any documents for this query. Set tofalseto throw an exception if the field is not mapped.
-
-
Hide has_child attributes Show has_child attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
typeand not return any documents instead of an error. -
Hide inner_hits attributes Show inner_hits attributes object
-
The maximum number of hits to return per
inner_hits. -
Inner hit starting document offset.
-
Hide collapse attributes Show collapse attributes object
-
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Maximum number of child documents that match the query allowed for a returned parent document. If the parent document exceeds this limit, it is excluded from the search results.
-
Minimum number of child documents that match the query required to match the query for a returned parent document. If the parent document does not meet this limit, it is excluded from the search results.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
none,avg,sum,max, ormin.
-
-
Hide has_parent attributes Show has_parent attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
parent_typeand not return any documents instead of an error. You can use this parameter to query multiple indices that may not contain theparent_type. -
Hide inner_hits attributes Show inner_hits attributes object
-
The maximum number of hits to return per
inner_hits. -
Inner hit starting document offset.
-
Hide collapse attributes Show collapse attributes object
-
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Indicates whether the relevance score of a matching parent document is aggregated into its child documents.
-
-
Hide ids attributes Show ids attributes object
-
Returns documents based on the order and proximity of matching terms.
External documentation -
Hide knn attributes Show knn attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The number of nearest neighbor candidates to consider per shard
-
The final number of nearest neighbors to return as top hits
filter
object | array[object] Filters for the kNN search query
-
The minimum similarity for a vector to be considered a match
-
-
Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.
External documentation -
Hide match_all attributes Show match_all attributes object
-
Analyzes its input and constructs a
boolquery from the terms. Each term except the last is used in atermquery. The last term is used in a prefix query.External documentation -
Hide match_none attributes Show match_none attributes object
-
Analyzes the text and creates a phrase query out of the analyzed text.
External documentation -
Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.
External documentation -
Hide more_like_this attributes Show more_like_this attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The analyzer that is used to analyze the free form text. Defaults to the analyzer associated with the first field in fields.
External documentation -
Each term in the formed query could be further boosted by their tf-idf score. This sets the boost factor to use when using this feature. Defaults to deactivated (0).
-
Controls whether the query should fail (throw an exception) if any of the specified fields are not of the supported types (
textorkeyword). -
A list of fields to fetch and analyze the text from. Defaults to the
index.query.default_fieldindex setting, which has a default value of*. -
Specifies whether the input documents should also be included in the search results returned.
-
The maximum document frequency above which the terms are ignored from the input document.
-
The maximum number of query terms that can be selected.
-
The maximum word length above which the terms are ignored. Defaults to unbounded (
0). -
The minimum document frequency below which the terms are ignored from the input document.
-
The minimum term frequency below which the terms are ignored from the input document.
-
The minimum word length below which the terms are ignored.
stop_words
string | array[string] Language value, such as arabic or thai. Defaults to english. Each language value corresponds to a predefined list of stop words in Lucene. See Stop words by language for supported language values and their stop words. Also accepts an array of stop words.
One of: Values are
_arabic_,_armenian_,_basque_,_bengali_,_brazilian_,_bulgarian_,_catalan_,_cjk_,_czech_,_danish_,_dutch_,_english_,_estonian_,_finnish_,_french_,_galician_,_german_,_greek_,_hindi_,_hungarian_,_indonesian_,_irish_,_italian_,_latvian_,_lithuanian_,_norwegian_,_persian_,_portuguese_,_romanian_,_russian_,_serbian_,_sorani_,_spanish_,_swedish_,_thai_,_turkish_, or_none_.-
Values are
internal,external,external_gte, orforce.
-
-
Hide multi_match attributes Show multi_match attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Analyzer used to convert the text in the query value into tokens.
-
If
true, match phrase queries are automatically created for multi-term synonyms. -
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). Can be applied to the term subqueries constructed for all terms but the final term. -
If
true, format-based errors, such as providing a text query value for a numeric field, are ignored. -
Maximum number of terms to which the query will expand.
-
Values are
and,AND,or, orOR. -
Number of beginning characters left unchanged for fuzzy matching.
-
Text, number, boolean value or date you wish to find in the provided field.
-
Maximum number of positions allowed between matching tokens.
-
Determines how scores for each per-term blended query and scores across groups are combined.
-
Values are
best_fields,most_fields,cross_fields,phrase,phrase_prefix, orbool_prefix. -
Values are
allornone.
-
-
Hide nested attributes Show nested attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped path and not return any documents instead of an error.
-
Hide inner_hits attributes Show inner_hits attributes object
-
The maximum number of hits to return per
inner_hits. -
Inner hit starting document offset.
-
Hide collapse attributes Show collapse attributes object
-
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Values are
none,avg,sum,max, ormin.
-
-
Hide parent_id attributes Show parent_id attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Indicates whether to ignore an unmapped
typeand not return any documents instead of an error.
-
-
Hide percolate attributes Show percolate attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The source of the document being percolated.
-
An array of sources of the documents being percolated.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The suffix used for the
_percolator_document_slotfield when multiplepercolatequeries are specified. -
Preference used to fetch document to percolate.
-
-
Hide pinned attributes Show pinned attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Document IDs listed in the order they are to appear in results. Required if
docsis not specified. -
Documents listed in the order they are to appear in results. Required if
idsis not specified.
-
-
Returns documents that contain a specific prefix in a provided field.
External documentation -
Hide query_string attributes Show query_string attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
If
true, the wildcard characters*and?are allowed as the first character of the query string. -
Analyzer used to convert text in the query string into tokens.
-
If
true, the query attempts to analyze wildcard terms in the query string. -
If
true, match phrase queries are automatically created for multi-term synonyms. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Values are
and,AND,or, orOR. -
If
true, enable position increments in queries constructed from aquery_stringsearch. -
Array of fields to search. Supports wildcards (
*). -
Maximum number of terms to which the query expands for fuzzy matching.
-
Number of beginning characters left unchanged for fuzzy matching.
-
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). -
If
true, format-based errors, such as providing a text value for a numeric field, are ignored. -
Maximum number of automaton states required for the query.
-
Maximum number of positions allowed between matching tokens for phrases.
-
Query string you wish to parse and use for search.
-
Analyzer used to convert quoted text in the query string into tokens. For quoted text, this parameter overrides the analyzer specified in the
analyzerparameter. -
Suffix appended to quoted text in the query string. You can use this suffix to use a different analysis method for exact matches.
-
How to combine the queries generated from the individual search terms in the resulting
dis_maxquery. -
Values are
best_fields,most_fields,cross_fields,phrase,phrase_prefix, orbool_prefix.
-
-
Returns documents that contain terms within a provided range.
External documentation -
Hide rank_feature attributes Show rank_feature attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
Returns documents that contain terms matching a regular expression.
External documentation -
Hide rule attributes Show rule attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide script attributes Show script attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Hide script attributes Show script attributes object
-
-
Hide script_score attributes Show script_score attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Documents with a score lower than this floating point number are excluded from the search results.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Hide script attributes Show script attributes object
-
-
Hide semantic attributes Show semantic attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The field to query, which must be a semantic_text field type
-
The query text
-
-
Hide shape attributes Show shape attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
When set to
truethe query ignores an unmapped field and will not match any documents.
-
-
Hide simple_query_string attributes Show simple_query_string attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Analyzer used to convert text in the query string into tokens.
-
If
true, the query attempts to analyze wildcard terms in the query string. -
If
true, the parser creates a match_phrase query for each multi-position token. -
Values are
and,AND,or, orOR. -
Array of fields you wish to search. Accepts wildcard expressions. You also can boost relevance scores for matches to particular fields using a caret (
^) notation. Defaults to theindex.query.default_field indexsetting, which has a default value of*. flags
string Query flags can be either a single flag or a combination of flags, e.g.
OR|AND|PREFIX-
Maximum number of terms to which the query expands for fuzzy matching.
-
Number of beginning characters left unchanged for fuzzy matching.
-
If
true, edits for fuzzy matching include transpositions of two adjacent characters (for example,abtoba). -
If
true, format-based errors, such as providing a text value for a numeric field, are ignored. -
Query string in the simple query string syntax you wish to parse and use for search.
-
Suffix appended to quoted text in the query string.
-
-
Hide span_containing attributes Show span_containing attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Hide big attributes Show big attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
Hide little attributes Show little attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
-
Hide span_field_masking attributes Show span_field_masking attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Hide query attributes Show query attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
-
Hide span_first attributes Show span_first attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Controls the maximum end position permitted in a match.
-
Hide match attributes Show match attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
-
Hide span_multi attributes Show span_multi attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
-
Hide span_near attributes Show span_near attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Array of one or more other span type queries.
Hide clauses attributes Show clauses attributes object
-
Controls whether matches are required to be in-order.
-
Controls the maximum number of intervening unmatched positions permitted.
-
-
Hide span_not attributes Show span_not attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
The number of tokens from within the include span that can’t have overlap with the exclude span. Equivalent to setting both
preandpost. -
Hide exclude attributes Show exclude attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
Hide include attributes Show include attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
The number of tokens after the include span that can’t have overlap with the exclude span.
-
The number of tokens before the include span that can’t have overlap with the exclude span.
-
-
Hide span_or attributes Show span_or attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Array of one or more other span type queries.
Hide clauses attributes Show clauses attributes object
-
-
Matches spans containing a term.
External documentation -
Hide span_within attributes Show span_within attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Hide big attributes Show big attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
Hide little attributes Show little attributes object
-
Can only be used as a clause in a span_near query.
-
The equivalent of the
termquery but for use with other span queries.
-
-
Hide sparse_vector attributes Show sparse_vector attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The query text you want to use for search. If inference_id is specified, query must also be specified.
-
Whether to perform pruning, omitting the non-significant tokens from the query to improve query performance. If prune is true but the pruning_config is not specified, pruning will occur but default values will be used. Default: false
-
Hide pruning_config attributes Show pruning_config attributes object
-
Tokens whose frequency is more than this threshold times the average frequency of all tokens in the specified field are considered outliers and pruned.
-
Tokens whose weight is less than this threshold are considered nonsignificant and pruned.
-
Whether to only score pruned tokens, vs only scoring kept tokens.
-
-
Dictionary of precomputed sparse vectors and their associated weights. Only one of inference_id or query_vector may be supplied in a request.
-
-
Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field's value, including whitespace and capitalization.
External documentation -
Hide terms attributes Show terms attributes object
-
Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.
External documentation -
Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field.
External documentation -
Supports returning text_expansion query results by sending in precomputed tokens with the query.
External documentation -
Returns documents that contain terms matching a wildcard pattern.
External documentation -
Hide wrapper attributes Show wrapper attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
A base64 encoded query. The binary data format can be any of JSON, YAML, CBOR or SMILE encodings
-
-
Hide type attributes Show type attributes object
-
Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.
-
-
-
Hide runtime_mappings attribute Show runtime_mappings attribute object
-
Hide * attributes Show * attributes object
-
For type
composite -
For type
lookup -
A custom format for
datetype runtime fields. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Hide script attributes Show script attributes object
source
string | object One of: Hide attributes Show attributes
-
Defines the aggregations that are run as part of the search request.
-
If
true, the request returns detailed information about score computation as part of a hit. -
Configuration of search extensions defined by Elasticsearch plugins.
-
The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterparameter. -
Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.
-
Boost the
_scoreof documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than1.0increases the score. A boost value between0and1.0decreases the score. -
An array of wildcard (
*) field patterns. The request returns doc values for field names matching these patterns in thehits.fieldsproperty of the response. -
The minimum
_scorefor matching documents. Documents with a lower_scoreare not included in search results or results collected by aggregations. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Set to
trueto return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution. -
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
-
Retrieve a script evaluation (based on different fields) for each hit.
-
A field value.
-
The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the
fromandsizeparameters. To page through more hits, use thesearch_afterproperty. -
An array of wildcard (
*) field patterns. The request returns values for field names matching these patterns in thehits.fieldsproperty of the response. -
The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.
IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to
0(default), the query does not terminate early. -
The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
-
If
true, calculate and return document scores, even if the scores are not used for sorting. -
If
true, the request returns the document version as part of a hit. -
If
true, the request returns sequence number and primary term of the last modification of each hit. -
The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.
-
-
Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
-
Values are
boolean,composite,date,double,geo_point,geo_shape,ip,keyword,long, orlookup.
-
-
-
Hide sync attribute Show sync attribute object
-
Hide time attributes Show time attributes object
-
A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
PUT _transform/ecommerce_transform1
{
"source": {
"index": "kibana_sample_data_ecommerce",
"query": {
"term": {
"geoip.continent_name": {
"value": "Asia"
}
}
}
},
"pivot": {
"group_by": {
"customer_id": {
"terms": {
"field": "customer_id",
"missing_bucket": true
}
}
},
"aggregations": {
"max_price": {
"max": {
"field": "taxful_total_price"
}
}
}
},
"description": "Maximum priced ecommerce data by customer_id in Asia",
"dest": {
"index": "kibana_sample_data_ecommerce_transform1",
"pipeline": "add_timestamp_pipeline"
},
"frequency": "5m",
"sync": {
"time": {
"field": "order_date",
"delay": "60s"
}
},
"retention_policy": {
"time": {
"field": "order_date",
"max_age": "30d"
}
}
}curl \
--request PUT 'http://api.example.com/_transform/{transform_id}' \
--header "Content-Type: application/json" \
--data '"{\n \"source\": {\n \"index\": \"kibana_sample_data_ecommerce\",\n \"query\": {\n \"term\": {\n \"geoip.continent_name\": {\n \"value\": \"Asia\"\n }\n }\n }\n },\n \"pivot\": {\n \"group_by\": {\n \"customer_id\": {\n \"terms\": {\n \"field\": \"customer_id\",\n \"missing_bucket\": true\n }\n }\n },\n \"aggregations\": {\n \"max_price\": {\n \"max\": {\n \"field\": \"taxful_total_price\"\n }\n }\n }\n },\n \"description\": \"Maximum priced ecommerce data by customer_id in Asia\",\n \"dest\": {\n \"index\": \"kibana_sample_data_ecommerce_transform1\",\n \"pipeline\": \"add_timestamp_pipeline\"\n },\n \"frequency\": \"5m\",\n \"sync\": {\n \"time\": {\n \"field\": \"order_date\",\n \"delay\": \"60s\"\n }\n },\n \"retention_policy\": {\n \"time\": {\n \"field\": \"order_date\",\n \"max_age\": \"30d\"\n }\n }\n}"'{
"source": {
"index": "kibana_sample_data_ecommerce",
"query": {
"term": {
"geoip.continent_name": {
"value": "Asia"
}
}
}
},
"pivot": {
"group_by": {
"customer_id": {
"terms": {
"field": "customer_id",
"missing_bucket": true
}
}
},
"aggregations": {
"max_price": {
"max": {
"field": "taxful_total_price"
}
}
}
},
"description": "Maximum priced ecommerce data by customer_id in Asia",
"dest": {
"index": "kibana_sample_data_ecommerce_transform1",
"pipeline": "add_timestamp_pipeline"
},
"frequency": "5m",
"sync": {
"time": {
"field": "order_date",
"delay": "60s"
}
},
"retention_policy": {
"time": {
"field": "order_date",
"max_age": "30d"
}
}
}{
"source": {
"index": "kibana_sample_data_ecommerce"
},
"latest": {
"unique_key": [
"customer_id"
],
"sort": "order_date"
},
"description": "Latest order for each customer",
"dest": {
"index": "kibana_sample_data_ecommerce_transform2"
},
"frequency": "5m",
"sync": {
"time": {
"field": "order_date",
"delay": "60s"
}
}
}{
"source": {
"index": [
"kibana_sample_data_ecommerce"
],
"query": {
"bool": {
"filter": {
"term": {
"currency": "EUR"
}
}
}
}
},
"pivot": {
"group_by": {
"customer_id": {
"terms": {
"field": "customer_id"
}
}
},
"aggregations": {
"total_quantity.sum": {
"sum": {
"field": "total_quantity"
}
},
"taxless_total_price.sum": {
"sum": {
"field": "taxless_total_price"
}
},
"total_quantity.max": {
"max": {
"field": "total_quantity"
}
},
"order_id.cardinality": {
"cardinality": {
"field": "order_id"
}
}
}
},
"dest": {
"index": "ecommerce-customers"
},
"retention_policy": {
"time": {
"field": "order_date",
"max_age": "60d"
}
}
}{
"acknowledged": true
}