Get behavioral analytics collections Deprecated Technical preview

GET /_application/analytics/{name}

Api key auth

All methods and paths for this operation:

GET /_application/analytics

GET /_application/analytics/{name}

Path parameters

name array[string] Required

A list of analytics collections to limit the returned information

Responses

200 application/json
Hide response attribute Show response attribute object
- * object Additional properties
  
  Hide * attribute Show * attribute object
  
  event_data_stream object Required
  
  Data stream for the collection.
  
  Hide event_data_stream attribute Show event_data_stream attribute object
  
  name string Required

GET /_application/analytics/{name}

GET _application/analytics/my*

resp = client.search_application.get_behavioral_analytics(
    name="my*",
)

const response = await client.searchApplication.getBehavioralAnalytics({
  name: "my*",
});

response = client.search_application.get_behavioral_analytics(
  name: "my*"
)

$resp = $client->searchApplication()->getBehavioralAnalytics([
    "name" => "my*",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_application/analytics/my*"

Response examples (200)

A successful response from `GET _application/analytics/my*`

{
  "my_analytics_collection": {
      "event_data_stream": {
          "name": "behavioral_analytics-events-my_analytics_collection"
      }
  },
  "my_analytics_collection2": {
      "event_data_stream": {
          "name": "behavioral_analytics-events-my_analytics_collection2"
      }
  }
}

Delete a behavioral analytics collection Deprecated Technical preview

DELETE /_application/analytics/{name}

Api key auth

The associated data stream is also deleted.

Path parameters

name string Required

The name of the analytics collection to be deleted

Responses

200 application/json
Hide response attribute Show response attribute object
- acknowledged boolean Required
  
  For a successful response, this value is always true. On failure, an exception is returned instead.

DELETE /_application/analytics/{name}

DELETE _application/analytics/my_analytics_collection/

resp = client.search_application.delete_behavioral_analytics(
    name="my_analytics_collection",
)

const response = await client.searchApplication.deleteBehavioralAnalytics({
  name: "my_analytics_collection",
});

response = client.search_application.delete_behavioral_analytics(
  name: "my_analytics_collection"
)

$resp = $client->searchApplication()->deleteBehavioralAnalytics([
    "name" => "my_analytics_collection",
]);

curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_application/analytics/my_analytics_collection/"

Compact and aligned text (CAT)

The compact and aligned text (CAT) APIs aim are intended only for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, it's recommend to use a corresponding JSON API. All the cat commands accept a query string parameter help to see all the headers and info they provide, and the /_cat command alone lists all the available commands.

Get CAT help Generally available

GET /_cat

Api key auth

Get help for the CAT APIs.

Responses

200 application/json

GET /_cat

curl \
 --request GET 'http://api.example.com/_cat' \
 --header "Authorization: $API_KEY"

Get datafeeds Generally available

GET /_cat/ml/datafeeds/{datafeed_id}

Api key auth

All methods and paths for this operation:

GET /_cat/ml/datafeeds

GET /_cat/ml/datafeeds/{datafeed_id}

Get configuration and usage information about datafeeds. This API returns a maximum of 10,000 datafeeds. If the Elasticsearch security features are enabled, you must have monitor_ml, monitor, manage_ml, or manage cluster privileges to use this API.

IMPORTANT: CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get datafeed statistics API.

Required authorization

Cluster privileges: monitor_ml

Path parameters

datafeed_id string Required

A numerical character string that uniquely identifies the datafeed.

Query parameters

allow_no_match boolean
Specifies what to do when the request:
- Contains wildcard expressions and there are no datafeeds that match.
- Contains the _all string or no identifiers and there are no matches.
- Contains wildcard expressions and there are only partial matches.
If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.
h string | array[string]
Comma-separated list of column names to display.

Supported values include:
- ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
- bc (or buckets.count, bucketsCount): The number of buckets processed.
- id: A numerical character string that uniquely identifies the datafeed.
- na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
- ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
- ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
- nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
- sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
- sc (or search.count, searchCount): The number of searches run by the datafeed.
- seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
- st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
- s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
s string | array[string]
Comma-separated list of column names or column aliases used to sort the response.

Supported values include:
- ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
- bc (or buckets.count, bucketsCount): The number of buckets processed.
- id: A numerical character string that uniquely identifies the datafeed.
- na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
- ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
- ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
- nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
- sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
- sc (or search.count, searchCount): The number of searches run by the datafeed.
- seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
- st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
- s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.

Responses

200 application/json
Hide response attributes Show response attributes object
- id string
  
  The datafeed identifier.
- state string
  
  The status of the datafeed.
  
  Values are started, stopped, starting, or stopping.
- assignment_explanation string
  
  For started datafeeds only, contains messages relating to the selection of a node.
- buckets.count string
  
  The number of buckets processed.
- search.count string
  
  The number of searches run by the datafeed.
- search.time string
  
  The total time the datafeed spent searching, in milliseconds.
- search.bucket_avg string
  
  The average search time per bucket, in milliseconds.
- search.exp_avg_hour string
  
  The exponential average search time per hour, in milliseconds.
- node.id string
  
  The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.
- node.name string
  
  The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.
- node.ephemeral_id string
  
  The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.
- node.address string
  
  The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

GET /_cat/ml/datafeeds/{datafeed_id}

GET _cat/ml/datafeeds?v=true&format=json

resp = client.cat.ml_datafeeds(
    v=True,
    format="json",
)

const response = await client.cat.mlDatafeeds({
  v: "true",
  format: "json",
});

response = client.cat.ml_datafeeds(
  v: "true",
  format: "json"
)

$resp = $client->cat()->mlDatafeeds([
    "v" => "true",
    "format" => "json",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_cat/ml/datafeeds?v=true&format=json"

Response examples (200)

A successful response from `GET _cat/ml/datafeeds?v=true&format=json`.

[
  {
    "id": "datafeed-high_sum_total_sales",
    "state": "stopped",
    "buckets.count": "743",
    "search.count": "7"
  },
  {
    "id": "datafeed-low_request_rate",
    "state": "stopped",
    "buckets.count": "1457",
    "search.count": "3"
  },
  {
    "id": "datafeed-response_code_rates",
    "state": "stopped",
    "buckets.count": "1460",
    "search.count": "18"
  },
  {
    "id": "datafeed-url_scanning",
    "state": "stopped",
    "buckets.count": "1460",
    "search.count": "18"
  }
]

Get trained models Generally available

GET /_cat/ml/trained_models/{model_id}

Api key auth

All methods and paths for this operation:

GET /_cat/ml/trained_models

GET /_cat/ml/trained_models/{model_id}

Get configuration and usage information about inference trained models.

IMPORTANT: CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get trained models statistics API.

Required authorization

Cluster privileges: monitor_ml

Path parameters

model_id string Required

A unique identifier for the trained model.

Query parameters

allow_no_match boolean

Specifies what to do when the request: contains wildcard expressions and there are no models that match; contains the _all string or no identifiers and there are no matches; contains wildcard expressions and there are only partial matches. If true, the API returns an empty array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.
h string | array[string]
A comma-separated list of column names to display.

Supported values include:
- create_time (or ct): The time when the trained model was created.
- created_by (or c, createdBy): Information on the creator of the trained model.
- data_frame_analytics_id (or df, dataFrameAnalytics, dfid): Identifier for the data frame analytics job that created the model. Only displayed if it is still available.
- description (or d): The description of the trained model.
- heap_size (or hs, modelHeapSize): The estimated heap size to keep the trained model in memory.
- id: Identifier for the trained model.
- ingest.count (or ic, ingestCount): The total number of documents that are processed by the model.
- ingest.current (or icurr, ingestCurrent): The total number of document that are currently being handled by the trained model.
- ingest.failed (or if, ingestFailed): The total number of failed ingest attempts with the trained model.
- ingest.pipelines (or ip, ingestPipelines): The total number of ingest pipelines that are referencing the trained model.
- ingest.time (or it, ingestTime): The total time that is spent processing documents with the trained model.
- license (or l): The license level of the trained model.
- operations (or o, modelOperations): The estimated number of operations to use the trained model. This number helps measuring the computational complexity of the model.
- version (or v): The Elasticsearch version number in which the trained model was created.
s string | array[string]
A comma-separated list of column names or aliases used to sort the response.

Supported values include:
- create_time (or ct): The time when the trained model was created.
- created_by (or c, createdBy): Information on the creator of the trained model.
- data_frame_analytics_id (or df, dataFrameAnalytics, dfid): Identifier for the data frame analytics job that created the model. Only displayed if it is still available.
- description (or d): The description of the trained model.
- heap_size (or hs, modelHeapSize): The estimated heap size to keep the trained model in memory.
- id: Identifier for the trained model.
- ingest.count (or ic, ingestCount): The total number of documents that are processed by the model.
- ingest.current (or icurr, ingestCurrent): The total number of document that are currently being handled by the trained model.
- ingest.failed (or if, ingestFailed): The total number of failed ingest attempts with the trained model.
- ingest.pipelines (or ip, ingestPipelines): The total number of ingest pipelines that are referencing the trained model.
- ingest.time (or it, ingestTime): The total time that is spent processing documents with the trained model.
- license (or l): The license level of the trained model.
- operations (or o, modelOperations): The estimated number of operations to use the trained model. This number helps measuring the computational complexity of the model.
- version (or v): The Elasticsearch version number in which the trained model was created.
from number

Skips the specified number of transforms.
size number

The maximum number of transforms to display.

Responses

200 application/json
Hide response attributes Show response attributes object
- id string
  
  The model identifier.
- created_by string
  
  Information about the creator of the model.
- heap_size number | string
  
  The estimated heap size to keep the model in memory.
  
  One of:
  number-1 number string-2 string
  
  The estimated heap size to keep the model in memory.
- operations string
  
  The estimated number of operations to use the model. This number helps to measure the computational complexity of the model.
- license string
  
  The license level of the model.
- create_time string | number
  
  The time the model was created.
  
  One of:
  string-1 string UnitMillis number
  
  The time the model was created.
- version string
  
  The version of Elasticsearch when the model was created.
- description string
  
  A description of the model.
- ingest.pipelines string
  
  The number of pipelines that are referencing the model.
- ingest.count string
  
  The total number of documents that are processed by the model.
- ingest.time string
  
  The total time spent processing documents with thie model.
- ingest.current string
  
  The total number of documents that are currently being handled by the model.
- ingest.failed string
  
  The total number of failed ingest attempts with the model.
- data_frame.id string
  
  The identifier for the data frame analytics job that created the model. Only displayed if the job is still available.
- data_frame.create_time string
  
  The time the data frame analytics job was created.
- data_frame.source_index string
  
  The source index used to train in the data frame analysis.
- data_frame.analysis string
  
  The analysis used by the data frame to build the model.
- type string Generally available

GET /_cat/ml/trained_models/{model_id}

GET _cat/ml/trained_models?v=true&format=json

resp = client.cat.ml_trained_models(
    v=True,
    format="json",
)

const response = await client.cat.mlTrainedModels({
  v: "true",
  format: "json",
});

response = client.cat.ml_trained_models(
  v: "true",
  format: "json"
)

$resp = $client->cat()->mlTrainedModels([
    "v" => "true",
    "format" => "json",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_cat/ml/trained_models?v=true&format=json"

Response examples (200)

A successful response from `GET _cat/ml/trained_models?v=true&format=json`.

[
  {
    "id": "ddddd-1580216177138",
    "heap_size": "0b",
    "operations": "196",
    "create_time": "2025-03-25T00:01:38.662Z",
    "type": "pytorch",
    "ingest.pipelines": "0",
    "data_frame.id": "__none__"
  },
  {
    "id": "lang_ident_model_1",
    "heap_size": "1mb",
    "operations": "39629",
    "create_time": "2019-12-05T12:28:34.594Z",
    "type": "lang_ident",
    "ingest.pipelines": "0",
    "data_frame.id": "__none__"
  }
]

Get transform information Generally available

GET /_cat/transforms/{transform_id}

Api key auth

All methods and paths for this operation:

GET /_cat/transforms

GET /_cat/transforms/{transform_id}

Get configuration and usage information about transforms.

CAT APIs are only intended for human consumption using the Kibana console or command line. They are not intended for use by applications. For application consumption, use the get transform statistics API.

Required authorization

Cluster privileges: monitor_transform

Path parameters

transform_id string Required

A transform identifier or a wildcard expression. If you do not specify one of these options, the API returns information for all transforms.

Query parameters

allow_no_match boolean

Specifies what to do when the request: contains wildcard expressions and there are no transforms that match; contains the _all string or no identifiers and there are no matches; contains wildcard expressions and there are only partial matches. If true, it returns an empty transforms array when there are no matches and the subset of results when there are partial matches. If false, the request returns a 404 status code when there are no matches or only partial matches.
from number

Skips the specified number of transforms.
h string | array[string]
Comma-separated list of column names to display.

Supported values include:
- changes_last_detection_time (or cldt): The timestamp when changes were last detected in the source indices.
- checkpoint (or cp): The sequence number for the checkpoint.
- checkpoint_duration_time_exp_avg (or cdtea, checkpointTimeExpAvg): Exponential moving average of the duration of the checkpoint, in milliseconds.
- checkpoint_progress (or c, checkpointProgress): The progress of the next checkpoint that is currently in progress.
- create_time (or ct, createTime): The time the transform was created.
- delete_time (or dtime): The amount of time spent deleting, in milliseconds.
- description (or d): The description of the transform.
- dest_index (or di, destIndex): The destination index for the transform. The mappings of the destination index are deduced based on the source fields when possible. If alternate mappings are required, use the Create index API prior to starting the transform.
- documents_deleted (or docd): The number of documents that have been deleted from the destination index due to the retention policy for this transform.
- documents_indexed (or doci): The number of documents that have been indexed into the destination index for the transform.
- docs_per_second (or dps): Specifies a limit on the number of input documents per second. This setting throttles the transform by adding a wait time between search requests. The default value is null, which disables throttling.
- documents_processed (or docp): The number of documents that have been processed from the source index of the transform.
- frequency (or f): The interval between checks for changes in the source indices when the transform is running continuously. Also determines the retry interval in the event of transient failures while the transform is searching or indexing. The minimum value is 1s and the maximum is 1h. The default value is 1m.
- id: Identifier for the transform.
- index_failure (or if): The number of indexing failures.
- index_time (or itime): The amount of time spent indexing, in milliseconds.
- index_total (or it): The number of index operations.
- indexed_documents_exp_avg (or idea): Exponential moving average of the number of new documents that have been indexed.
- last_search_time (or lst, lastSearchTime): The timestamp of the last search in the source indices. This field is only shown if the transform is running.
- max_page_search_size (or mpsz): Defines the initial page size to use for the composite aggregation for each checkpoint. If circuit breaker exceptions occur, the page size is dynamically adjusted to a lower value. The minimum value is 10 and the maximum is 65,536. The default value is 500.
- pages_processed (or pp): The number of search or bulk index operations processed. Documents are processed in batches instead of individually.
- pipeline (or p): The unique identifier for an ingest pipeline.
- processed_documents_exp_avg (or pdea): Exponential moving average of the number of documents that have been processed.
- processing_time (or pt): The amount of time spent processing results, in milliseconds.
- reason (or r): If a transform has a failed state, this property provides details about the reason for the failure.
- search_failure (or sf): The number of search failures.
- search_time (or stime): The amount of time spent searching, in milliseconds.
- search_total (or st): The number of search operations on the source index for the transform.
- source_index (or si, sourceIndex): The source indices for the transform. It can be a single index, an index pattern (for example, "my-index-*"), an array of indices (for example, ["my-index-000001", "my-index-000002"]), or an array of index patterns (for example, ["my-index-*", "my-other-index-*"]. For remote indices use the syntax "remote_name:index_name". If any indices are in remote clusters then the master node and at least one transform node must have the remote_cluster_client node role.
- state (or s): The status of the transform, which can be one of the following values:
  - aborting: The transform is aborting.
  - failed: The transform failed. For more information about the failure, check the reason field.
  - indexing: The transform is actively processing data and creating new documents.
  - started: The transform is running but not actively indexing data.
  - stopped: The transform is stopped.
  - stopping: The transform is stopping.
- transform_type (or tt): Indicates the type of transform: batch or continuous.
- trigger_count (or tc): The number of times the transform has been triggered by the scheduler. For example, the scheduler triggers the transform indexer to check for updates or ingest new data at an interval specified in the frequency property.
- version (or v): The version of Elasticsearch that existed on the node when the transform was created.
s string | array[string]
Comma-separated list of column names or column aliases used to sort the response.

Supported values include:
- changes_last_detection_time (or cldt): The timestamp when changes were last detected in the source indices.
- checkpoint (or cp): The sequence number for the checkpoint.
- checkpoint_duration_time_exp_avg (or cdtea, checkpointTimeExpAvg): Exponential moving average of the duration of the checkpoint, in milliseconds.
- checkpoint_progress (or c, checkpointProgress): The progress of the next checkpoint that is currently in progress.
- create_time (or ct, createTime): The time the transform was created.
- delete_time (or dtime): The amount of time spent deleting, in milliseconds.
- description (or d): The description of the transform.
- dest_index (or di, destIndex): The destination index for the transform. The mappings of the destination index are deduced based on the source fields when possible. If alternate mappings are required, use the Create index API prior to starting the transform.
- documents_deleted (or docd): The number of documents that have been deleted from the destination index due to the retention policy for this transform.
- documents_indexed (or doci): The number of documents that have been indexed into the destination index for the transform.
- docs_per_second (or dps): Specifies a limit on the number of input documents per second. This setting throttles the transform by adding a wait time between search requests. The default value is null, which disables throttling.
- documents_processed (or docp): The number of documents that have been processed from the source index of the transform.
- frequency (or f): The interval between checks for changes in the source indices when the transform is running continuously. Also determines the retry interval in the event of transient failures while the transform is searching or indexing. The minimum value is 1s and the maximum is 1h. The default value is 1m.
- id: Identifier for the transform.
- index_failure (or if): The number of indexing failures.
- index_time (or itime): The amount of time spent indexing, in milliseconds.
- index_total (or it): The number of index operations.
- indexed_documents_exp_avg (or idea): Exponential moving average of the number of new documents that have been indexed.
- last_search_time (or lst, lastSearchTime): The timestamp of the last search in the source indices. This field is only shown if the transform is running.
- max_page_search_size (or mpsz): Defines the initial page size to use for the composite aggregation for each checkpoint. If circuit breaker exceptions occur, the page size is dynamically adjusted to a lower value. The minimum value is 10 and the maximum is 65,536. The default value is 500.
- pages_processed (or pp): The number of search or bulk index operations processed. Documents are processed in batches instead of individually.
- pipeline (or p): The unique identifier for an ingest pipeline.
- processed_documents_exp_avg (or pdea): Exponential moving average of the number of documents that have been processed.
- processing_time (or pt): The amount of time spent processing results, in milliseconds.
- reason (or r): If a transform has a failed state, this property provides details about the reason for the failure.
- search_failure (or sf): The number of search failures.
- search_time (or stime): The amount of time spent searching, in milliseconds.
- search_total (or st): The number of search operations on the source index for the transform.
- source_index (or si, sourceIndex): The source indices for the transform. It can be a single index, an index pattern (for example, "my-index-*"), an array of indices (for example, ["my-index-000001", "my-index-000002"]), or an array of index patterns (for example, ["my-index-*", "my-other-index-*"]. For remote indices use the syntax "remote_name:index_name". If any indices are in remote clusters then the master node and at least one transform node must have the remote_cluster_client node role.
- state (or s): The status of the transform, which can be one of the following values:
  - aborting: The transform is aborting.
  - failed: The transform failed. For more information about the failure, check the reason field.
  - indexing: The transform is actively processing data and creating new documents.
  - started: The transform is running but not actively indexing data.
  - stopped: The transform is stopped.
  - stopping: The transform is stopping.
- transform_type (or tt): Indicates the type of transform: batch or continuous.
- trigger_count (or tc): The number of times the transform has been triggered by the scheduler. For example, the scheduler triggers the transform indexer to check for updates or ingest new data at an interval specified in the frequency property.
- version (or v): The version of Elasticsearch that existed on the node when the transform was created.
size number

The maximum number of transforms to obtain.

Responses

200 application/json
Hide response attributes Show response attributes object
- id string
  
  The transform identifier.
- state string
  
  The status of the transform. Returned values include: aborting: The transform is aborting. failed: The transform failed. For more information about the failure, check thereasonfield.indexing: The transform is actively processing data and creating new documents.started: The transform is running but not actively indexing data.stopped: The transform is stopped.stopping`: The transform is stopping.
- checkpoint string
  
  The sequence number for the checkpoint.
- documents_processed string
  
  The number of documents that have been processed from the source index of the transform.
- checkpoint_progress string | null
  
  The progress of the next checkpoint that is currently in progress.
  
  One of:
  string-1 string string-2 string | null
- last_search_time string | null
  
  The timestamp of the last search in the source indices. This field is shown only if the transform is running.
  
  One of:
  string-1 string string-2 string | null
- changes_last_detection_time string | null
  
  The timestamp when changes were last detected in the source indices.
  
  One of:
  string-1 string string-2 string | null
- create_time string
  
  The time the transform was created.
- version string
  
  The version of Elasticsearch that existed on the node when the transform was created.
- source_index string
  
  The source indices for the transform.
- dest_index string
  
  The destination index for the transform.
- pipeline string
  
  The unique identifier for the ingest pipeline.
- description string
  
  The description of the transform.
- transform_type string
  
  The type of transform: batch or continuous.
- frequency string
  
  The interval between checks for changes in the source indices when the transform is running continuously.
- max_page_search_size string
  
  The initial page size that is used for the composite aggregation for each checkpoint.
- docs_per_second string
  
  The number of input documents per second.
- reason string
  
  If a transform has a failed state, these details describe the reason for failure.
- search_total string
  
  The total number of search operations on the source index for the transform.
- search_failure string
  
  The total number of search failures.
- search_time string
  
  The total amount of search time, in milliseconds.
- index_total string
  
  The total number of index operations done by the transform.
- index_failure string
  
  The total number of indexing failures.
- index_time string
  
  The total time spent indexing documents, in milliseconds.
- documents_indexed string
  
  The number of documents that have been indexed into the destination index for the transform.
- delete_time string
  
  The total time spent deleting documents, in milliseconds.
- documents_deleted string
  
  The number of documents deleted from the destination index due to the retention policy for the transform.
- trigger_count string
  
  The number of times the transform has been triggered by the scheduler. For example, the scheduler triggers the transform indexer to check for updates or ingest new data at an interval specified in the frequency property.
- pages_processed string
  
  The number of search or bulk index operations processed. Documents are processed in batches instead of individually.
- processing_time string
  
  The total time spent processing results, in milliseconds.
- checkpoint_duration_time_exp_avg string
  
  The exponential moving average of the duration of the checkpoint, in milliseconds.
- indexed_documents_exp_avg string
  
  The exponential moving average of the number of new documents that have been indexed.
- processed_documents_exp_avg string
  
  The exponential moving average of the number of documents that have been processed.

GET /_cat/transforms/{transform_id}

GET /_cat/transforms?v=true&format=json

resp = client.cat.transforms(
    v=True,
    format="json",
)

const response = await client.cat.transforms({
  v: "true",
  format: "json",
});

response = client.cat.transforms(
  v: "true",
  format: "json"
)

$resp = $client->cat()->transforms([
    "v" => "true",
    "format" => "json",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_cat/transforms?v=true&format=json"

Response examples (200)

A successful response from `GET /_cat/transforms?v=true&format=json`.

[
  {
    "id" : "ecommerce_transform",
    "state" : "started",
    "checkpoint" : "1",
    "documents_processed" : "705",
    "checkpoint_progress" : "100.00",
    "changes_last_detection_time" : null
  }
]

Connector

The connector and sync jobs APIs provide a convenient way to create and manage Elastic connectors and sync jobs in an internal index. Connectors are Elasticsearch integrations for syncing content from third-party data sources, which can be deployed on Elastic Cloud or hosted on your own infrastructure. This API provides an alternative to relying solely on Kibana UI for connector and sync job management. The API comes with a set of validations and assertions to ensure that the state representation in the internal index remains valid. This API requires the manage_connector privilege or, for read-only endpoints, the monitor_connector privilege.

Check out the connector API tutorial

Check in a connector Technical preview

PUT /_connector/{connector_id}/_check_in

Api key auth

Update the last_seen field in the connector and set it to the current timestamp.

Path parameters

connector_id string Required

The unique identifier of the connector to be checked in

Responses

200 application/json
Hide response attribute Show response attribute object
- result string Required
  
  Values are created, updated, deleted, not_found, or noop.

PUT /_connector/{connector_id}/_check_in

PUT _connector/my-connector/_check_in

resp = client.connector.check_in(
    connector_id="my-connector",
)

const response = await client.connector.checkIn({
  connector_id: "my-connector",
});

response = client.connector.check_in(
  connector_id: "my-connector"
)

$resp = $client->connector()->checkIn([
    "connector_id" => "my-connector",
]);

curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_connector/my-connector/_check_in"

Response examples (200)

{
    "result": "updated"
}

Get a connector Beta

GET /_connector/{connector_id}

Api key auth

Get the details about a connector.

Path parameters

connector_id string Required

The unique identifier of the connector

Query parameters

include_deleted boolean

A flag to indicate if the desired connector should be fetched, even if it was soft-deleted.

Responses

200 application/json
Hide response attributes Show response attributes object
- api_key_id string
- api_key_secret_id string
- configuration object Required
  
  Hide configuration attribute Show configuration attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  category string
  
  default_value number | string | boolean | null
  
  One of:
  number-1 number number-2 number string-3 string boolean-4 boolean string-5 string | null
  
  depends_on array[object] Required
  
  Hide depends_on attributes Show depends_on attributes object
  
  field string Required
  
  value
  
  display string Required
  
  Values are textbox, textarea, numeric, toggle, or dropdown.
  
  label string Required
  
  options array[object] Required
  
  Hide options attributes Show options attributes object
  
  label string Required
  
  value
  
  order number
  
  placeholder string
  
  required boolean Required
  
  sensitive boolean Required
  
  tooltip string | null
  
  One of:
  string-1 string string-2 string | null
  
  type string
  
  Values are str, int, list, or bool.
  
  ui_restrictions array[string]
  
  validations array[object]
  
  value object Required
- custom_scheduling object Required
  
  Hide custom_scheduling attribute Show custom_scheduling attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  configuration_overrides object Required
  
  Hide configuration_overrides attributes Show configuration_overrides attributes object
  
  max_crawl_depth number
  
  sitemap_discovery_disabled boolean
  
  domain_allowlist array[string]
  
  sitemap_urls array[string]
  
  seed_urls array[string]
  
  enabled boolean Required
  
  interval string Required
  
  last_synced string
  
  name string Required
- deleted boolean Required
- description string
- error string | null
  
  One of:
  string-1 string string-2 string | null
- features object
  
  Hide features attributes Show features attributes object
  
  document_level_security object
  
  Indicates whether document-level security is enabled.
  
  Hide document_level_security attribute Show document_level_security attribute object
  
  enabled boolean Required
  
  incremental_sync object
  
  Indicates whether incremental syncs are enabled.
  
  Hide incremental_sync attribute Show incremental_sync attribute object
  
  enabled boolean Required
  
  native_connector_api_keys object
  
  Indicates whether managed connector API keys are enabled.
  
  Hide native_connector_api_keys attribute Show native_connector_api_keys attribute object
  
  enabled boolean Required
  
  sync_rules object
  
  Hide sync_rules attributes Show sync_rules attributes object
  
  advanced object
  
  Indicates whether advanced sync rules are enabled.
  
  basic object
  
  Indicates whether basic sync rules are enabled.
- filtering array[object] Required
  
  Hide filtering attributes Show filtering attributes object
  
  active object Required
  
  Hide active attributes Show active attributes object
  
  advanced_snippet object Required
  
  rules array[object] Required
  
  validation object Required
  
  domain string
  
  draft object Required
  
  Hide draft attributes Show draft attributes object
  
  advanced_snippet object Required
  
  rules array[object] Required
  
  validation object Required
- id string
- index_name string | null
  
  One of:
  IndexName string string-2 string | null
- is_native boolean Required
- language string
- last_access_control_sync_error string
- last_access_control_sync_scheduled_at string | number
  
  One of:
  string-1 string UnitMillis number
- last_access_control_sync_status string
  
  Values are canceling, canceled, completed, error, in_progress, pending, or suspended.
- last_deleted_document_count number
- last_incremental_sync_scheduled_at string | number
  
  One of:
  string-1 string UnitMillis number
- last_indexed_document_count number
- last_seen string | number
  
  One of:
  string-1 string UnitMillis number
- last_sync_error string
- last_sync_scheduled_at string | number
  
  One of:
  string-1 string UnitMillis number
- last_sync_status string
  
  Values are canceling, canceled, completed, error, in_progress, pending, or suspended.
- last_synced string | number
  
  One of:
  string-1 string UnitMillis number
- name string
- pipeline object
  
  Hide pipeline attributes Show pipeline attributes object
  
  extract_binary_content boolean Required
  
  name string Required
  
  reduce_whitespace boolean Required
  
  run_ml_inference boolean Required
- scheduling object Required
  
  Hide scheduling attributes Show scheduling attributes object
  
  access_control object
  
  Hide access_control attributes Show access_control attributes object
  
  enabled boolean Required
  
  interval string Required
  
  The interval is expressed using the crontab syntax
  
  full object
  
  Hide full attributes Show full attributes object
  
  enabled boolean Required
  
  interval string Required
  
  The interval is expressed using the crontab syntax
  
  incremental object
  
  Hide incremental attributes Show incremental attributes object
  
  enabled boolean Required
  
  interval string Required
  
  The interval is expressed using the crontab syntax
- service_type string
- status string Required
  
  Values are created, needs_configuration, configured, connected, or error.
- sync_cursor object
- sync_now boolean Required

GET /_connector/{connector_id}

GET _connector/my-connector-id

resp = client.connector.get(
    connector_id="my-connector-id",
)

const response = await client.connector.get({
  connector_id: "my-connector-id",
});

response = client.connector.get(
  connector_id: "my-connector-id"
)

$resp = $client->connector()->get([
    "connector_id" => "my-connector-id",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_connector/my-connector-id"

Create or update a connector Beta

PUT /_connector/{connector_id}

Api key auth

All methods and paths for this operation:

PUT /_connector

PUT /_connector/{connector_id}

Path parameters

connector_id string Required

The unique identifier of the connector to be created or updated. ID is auto-generated if not provided.

application/json

Body

description string
index_name string
is_native boolean
language string
name string
service_type string

Responses

200 application/json
Hide response attributes Show response attributes object
- result string Required
  
  Values are created, updated, deleted, not_found, or noop.
- id string Required

PUT /_connector/{connector_id}

PUT _connector/my-connector
{
  "index_name": "search-google-drive",
  "name": "My Connector",
  "service_type": "google_drive"
}

resp = client.connector.put(
    connector_id="my-connector",
    index_name="search-google-drive",
    name="My Connector",
    service_type="google_drive",
)

const response = await client.connector.put({
  connector_id: "my-connector",
  index_name: "search-google-drive",
  name: "My Connector",
  service_type: "google_drive",
});

response = client.connector.put(
  connector_id: "my-connector",
  body: {
    "index_name": "search-google-drive",
    "name": "My Connector",
    "service_type": "google_drive"
  }
)

$resp = $client->connector()->put([
    "connector_id" => "my-connector",
    "body" => [
        "index_name" => "search-google-drive",
        "name" => "My Connector",
        "service_type" => "google_drive",
    ],
]);

curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"index_name":"search-google-drive","name":"My Connector","service_type":"google_drive"}' "$ELASTICSEARCH_URL/_connector/my-connector"

Request examples

{
  "index_name": "search-google-drive",
  "name": "My Connector",
  "service_type": "google_drive"
}

{
  "index_name": "search-google-drive",
  "name": "My Connector",
  "description": "My Connector to sync data to Elastic index from Google Drive",
  "service_type": "google_drive",
  "language": "english"
}

Response examples (200)

{
  "result": "created",
  "id": "my-connector"
}

Get behavioral analytics collections Deprecated Technical preview

Path parameters

Responses

Delete a behavioral analytics collection Deprecated Technical preview

Path parameters

Responses

Compact and aligned text (CAT)

Get CAT help Generally available

Responses

Get datafeeds Generally available

Required authorization

Path parameters

Query parameters

Responses

Get trained models Generally available

Required authorization

Path parameters

Query parameters

Responses

heap_size number | string

create_time string | number

Get transform information Generally available

Required authorization

Path parameters

Query parameters

Responses

checkpoint_progress string | null

last_search_time string | null

changes_last_detection_time string | null

Connector

Check in a connector Technical preview

Path parameters

Responses

Get a connector Beta

Path parameters

Query parameters

Responses

default_value number | string | boolean | null

tooltip string | null

error string | null

index_name string | null

last_access_control_sync_scheduled_at string | number

last_incremental_sync_scheduled_at string | number

last_seen string | number

last_sync_scheduled_at string | number

last_synced string | number

Create or update a connector Beta

Path parameters

Body

Responses