Start data frame analytics jobs APIedit

Starts a data frame analytics job.


POST _ml/data_frame/analytics/<data_frame_analytics_id>/_start


Requires the following privileges:

  • cluster: manage_ml (the machine_learning_admin built-in role grants this privilege)
  • source indices: read, view_index_metadata
  • destination index: read, create_index, manage and index


A data frame analytics job can be started and stopped multiple times throughout its lifecycle.

If the destination index does not exist, it is created automatically the first time you start the data frame analytics job. The index.number_of_shards and index.number_of_replicas settings for the destination index are copied from the source index. If there are multiple source indices, the destination index copies the highest setting values. The mappings for the destination index are also copied from the source indices. If there are any mapping conflicts, the job fails to start.

If the destination index exists, it is used as is. You can therefore set up the destination index in advance with custom settings and mappings.

When Elasticsearch security features are enabled, the data frame analytics job remembers which user created it and runs the job using those credentials. If you provided secondary authorization headers when you created the job, those credentials are used.

Path parametersedit

(Required, string) Identifier for the data frame analytics job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.

Query parametersedit

(Optional, time units) Controls the amount of time to wait until the data frame analytics job starts. Defaults to 20 seconds.

Response bodyedit

(Boolean) For a successful response, this value is always true. On failure, an exception is returned instead.
(string) The ID of the node that the job was started on. If the job is allowed to open lazily and has not yet been assigned to a node, this value is an empty string.


The following example starts the loganalytics data frame analytics job:

POST _ml/data_frame/analytics/loganalytics/_start

When the data frame analytics job starts, you receive the following results:

  "acknowledged" : true,
  "node" : "node-1"