Check if data streams have data Generally available; added in 9.6.0

GET /api/fleet/data_streams/data
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/fleet/data_streams/data

Refer to Spaces for more information.

Check whether one or more data stream index patterns contain any documents indexed at or after the given start time.

[Required authorization] Route required privileges: fleet-read.

Query parameters

  • dataStreams string Required

    A comma-separated list of data stream index patterns to check. Each pattern must be of the form logs-<dataset>-* or metrics-<dataset>-*.

    Maximum length is 4096.

  • start string Required

    An ISO 8601 timestamp. Only documents with an @timestamp at or after this time are considered.

    Maximum length is 64.

Responses

  • 200 application/json

    Successful response

    Hide response attribute Show response attribute object
    • results object Required

      One entry per requested index pattern. true when the pattern matched at least one document, false when it matched none or the pattern resolved to no index.

      Hide results attribute Show results attribute object
      • * boolean Additional properties
  • 400 application/json

    Bad request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
GET /api/fleet/data_streams/data 
curl \
 --request GET 'https://localhost:5601/api/fleet/data_streams/data?dataStreams=string&start=string' \
 --header "Authorization: $API_KEY"
Response examples (200)
One entry per requested index pattern 
{
  "results": {
    "logs-aws.cloudtrail-*": true,
    "metrics-aws.ec2-*": false
  }
}
Response examples (400)
A requested pattern is not a supported data stream wildcard 
{
  "error": "Bad Request",
  "message": "Invalid index pattern: \".security-7\"",
  "statusCode": 400
}