Preview Datafeeds API

edit

Previews a datafeed.

Request

edit

GET _xpack/ml/datafeeds/<datafeed_id>/_preview

Description

edit

The preview datafeeds API returns the first "page" of results from the search that is created by using the current datafeed settings. This preview shows the structure of the data that will be passed to the anomaly detection engine.

Path Parameters

edit
datafeed_id (required)
(string) Identifier for the datafeed

Authorization

edit

You must have monitor_ml, monitor, manage_ml, or manage cluster privileges to use this API. For more information, see Security privileges.

Security Integration

edit

When X-Pack security is enabled, the datafeed query will be previewed using the credentials of the user calling the preview datafeed API. When the datafeed is started it will run the query using the roles of the last user to create or update it. If the two sets of roles differ then the preview may not accurately reflect what the datafeed will return when started. To avoid such problems, the same user that creates/updates the datafeed should preview it to ensure it is returning the expected data.

Examples

edit

The following example obtains a preview of the datafeed-farequote datafeed:

GET _xpack/ml/datafeeds/datafeed-farequote/_preview

The data that is returned for this example is as follows:

[
  {
    "time": 1454803200000,
    "airline": "JZA",
    "doc_count": 5,
    "responsetime": 990.4628295898438
  },
  {
    "time": 1454803200000,
    "airline": "JBU",
    "doc_count": 23,
    "responsetime": 877.5927124023438
  },
  {
    "time": 1454803200000,
    "airline": "KLM",
    "doc_count": 42,
    "responsetime": 1355.481201171875
  }
]