Start data frame analytics jobs APIedit

Starts a data frame analytics job.

This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.


POST _ml/data_frame/analytics/<data_frame_analytics_id>/_start


If the Elasticsearch security features are enabled, you must have the following built-in roles and privileges:

  • machine_learning_admin
  • kibana_admin (UI only)
  • source indices: read, view_index_metadata
  • destination index: read, create_index, manage and index
  • cluster: monitor (UI only)

For more information, see Security privileges and Built-in roles.


A data frame analytics job can be started and stopped multiple times throughout its lifecycle.

If the destination index does not exist, it is created automatically the first time you start the data frame analytics job. The index.number_of_shards and index.number_of_replicas settings for the destination index are copied from the source index. If there are multiple source indices, the destination index copies the highest setting values. The mappings for the destination index are also copied from the source indices. If there are any mapping conflicts, the job fails to start.

If the destination index exists, it is used as is. You can therefore set up the destination index in advance with custom settings and mappings.

Path parametersedit

(Required, string) Identifier for the data frame analytics job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.

Query parametersedit

(Optional, time units) Controls the amount of time to wait until the data frame analytics job starts. Defaults to 20 seconds.


The following example starts the loganalytics data frame analytics job:

POST _ml/data_frame/analytics/loganalytics/_start

When the data frame analytics job starts, you receive the following results:

  "acknowledged" : true