Create filters APIedit

Instantiates a filter.


PUT _ml/filters/<filter_id>


Requires the manage_ml cluster privilege. This privilege is included in the machine_learning_admin built-in role.


A filter contains a list of strings. It can be used by one or more jobs. Specifically, filters are referenced in the custom_rules property of detector configuration objects. For more information, see Custom rules.

Path parametersedit

(Required, string) A string that uniquely identifies a filter.

Request bodyedit

(Optional, string) A description of the filter.
(Required, array of strings) The items of the filter. A wildcard * can be used at the beginning or the end of an item. Up to 10000 items are allowed in each filter.


response =
  filter_id: 'safe_domains',
  body: {
    description: 'A list of safe domains',
    items: [
puts response
PUT _ml/filters/safe_domains
  "description": "A list of safe domains",
  "items": ["*", ""]

When the filter is created, you receive the following response:

  "filter_id": "safe_domains",
  "description": "A list of safe domains",
  "items": ["*", ""]