elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
Creates and manages Machine Learning datafeeds. Datafeeds retrieve data from Elasticsearch for analysis by an anomaly detection job. Each anomaly detection job can have only one associated datafeed. See the ML Datafeed API documentation for more details.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";
// Required ML Job for the datafeed
const example = new elasticstack.index.ElasticsearchMlAnomalyDetector("example", {
jobId: "example-anomaly-job",
description: "Example anomaly detection job",
analysisConfig: [{
bucketSpan: "15m",
detectors: [{
"function": "count",
}],
}],
dataDescription: [{
timeField: "@timestamp",
timeFormat: "epoch_ms",
}],
});
// Basic ML Datafeed
const basic = new elasticstack.ElasticsearchMlDatafeed("basic", {
datafeedId: "my-basic-datafeed",
jobId: example.jobId,
indices: ["log-data-*"],
query: JSON.stringify({
match_all: {},
}),
});
// Comprehensive ML Datafeed with all options
const comprehensive = new elasticstack.ElasticsearchMlDatafeed("comprehensive", {
datafeedId: "my-comprehensive-datafeed",
jobId: example.jobId,
indices: [
"app-logs-*",
"system-logs-*",
],
query: JSON.stringify({
bool: {
must: [
{
range: {
"@timestamp": {
gte: "now-1h",
},
},
},
{
term: {
status: "error",
},
},
],
},
}),
scrollSize: 1000,
frequency: "30s",
queryDelay: "60s",
maxEmptySearches: 10,
chunkingConfig: {
mode: "manual",
timeSpan: "30m",
},
delayedDataCheckConfig: {
enabled: true,
checkWindow: "2h",
},
indicesOptions: {
ignoreUnavailable: true,
allowNoIndices: false,
expandWildcards: [
"open",
"closed",
],
},
runtimeMappings: JSON.stringify({
hour_of_day: {
type: "long",
script: {
source: "emit(doc['@timestamp'].value.getHour())",
},
},
}),
scriptFields: JSON.stringify({
my_script_field: {
script: {
source: "_score * doc['my_field'].value",
},
},
}),
});
import pulumi
import json
import pulumi_elasticstack as elasticstack
# Required ML Job for the datafeed
example = elasticstack.index.ElasticsearchMlAnomalyDetector("example",
job_id=example-anomaly-job,
description=Example anomaly detection job,
analysis_config=[{
bucketSpan: 15m,
detectors: [{
function: count,
}],
}],
data_description=[{
timeField: @timestamp,
timeFormat: epoch_ms,
}])
# Basic ML Datafeed
basic = elasticstack.ElasticsearchMlDatafeed("basic",
datafeed_id="my-basic-datafeed",
job_id=example["jobId"],
indices=["log-data-*"],
query=json.dumps({
"match_all": {},
}))
# Comprehensive ML Datafeed with all options
comprehensive = elasticstack.ElasticsearchMlDatafeed("comprehensive",
datafeed_id="my-comprehensive-datafeed",
job_id=example["jobId"],
indices=[
"app-logs-*",
"system-logs-*",
],
query=json.dumps({
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "now-1h",
},
},
},
{
"term": {
"status": "error",
},
},
],
},
}),
scroll_size=1000,
frequency="30s",
query_delay="60s",
max_empty_searches=10,
chunking_config={
"mode": "manual",
"time_span": "30m",
},
delayed_data_check_config={
"enabled": True,
"check_window": "2h",
},
indices_options={
"ignore_unavailable": True,
"allow_no_indices": False,
"expand_wildcards": [
"open",
"closed",
],
},
runtime_mappings=json.dumps({
"hour_of_day": {
"type": "long",
"script": {
"source": "emit(doc['@timestamp'].value.getHour())",
},
},
}),
script_fields=json.dumps({
"my_script_field": {
"script": {
"source": "_score * doc['my_field'].value",
},
},
}))
package main
import (
"encoding/json"
"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Required ML Job for the datafeed
example, err := elasticstack.NewElasticsearchMlAnomalyDetector(ctx, "example", &elasticstack.ElasticsearchMlAnomalyDetectorArgs{
JobId: "example-anomaly-job",
Description: "Example anomaly detection job",
AnalysisConfig: []map[string]interface{}{
map[string]interface{}{
"bucketSpan": "15m",
"detectors": []map[string]interface{}{
map[string]interface{}{
"function": "count",
},
},
},
},
DataDescription: []map[string]interface{}{
map[string]interface{}{
"timeField": "@timestamp",
"timeFormat": "epoch_ms",
},
},
})
if err != nil {
return err
}
tmpJSON0, err := json.Marshal(map[string]interface{}{
"match_all": map[string]interface{}{},
})
if err != nil {
return err
}
json0 := string(tmpJSON0)
// Basic ML Datafeed
_, err = elasticstack.NewElasticsearchMlDatafeed(ctx, "basic", &elasticstack.ElasticsearchMlDatafeedArgs{
DatafeedId: pulumi.String("my-basic-datafeed"),
JobId: example.JobId,
Indices: pulumi.StringArray{
pulumi.String("log-data-*"),
},
Query: pulumi.String(json0),
})
if err != nil {
return err
}
tmpJSON1, err := json.Marshal(map[string]interface{}{
"bool": map[string]interface{}{
"must": []interface{}{
map[string]interface{}{
"range": map[string]interface{}{
"@timestamp": map[string]interface{}{
"gte": "now-1h",
},
},
},
map[string]interface{}{
"term": map[string]interface{}{
"status": "error",
},
},
},
},
})
if err != nil {
return err
}
json1 := string(tmpJSON1)
tmpJSON2, err := json.Marshal(map[string]interface{}{
"hour_of_day": map[string]interface{}{
"type": "long",
"script": map[string]interface{}{
"source": "emit(doc['@timestamp'].value.getHour())",
},
},
})
if err != nil {
return err
}
json2 := string(tmpJSON2)
tmpJSON3, err := json.Marshal(map[string]interface{}{
"my_script_field": map[string]interface{}{
"script": map[string]interface{}{
"source": "_score * doc['my_field'].value",
},
},
})
if err != nil {
return err
}
json3 := string(tmpJSON3)
// Comprehensive ML Datafeed with all options
_, err = elasticstack.NewElasticsearchMlDatafeed(ctx, "comprehensive", &elasticstack.ElasticsearchMlDatafeedArgs{
DatafeedId: pulumi.String("my-comprehensive-datafeed"),
JobId: example.JobId,
Indices: pulumi.StringArray{
pulumi.String("app-logs-*"),
pulumi.String("system-logs-*"),
},
Query: pulumi.String(json1),
ScrollSize: pulumi.Float64(1000),
Frequency: pulumi.String("30s"),
QueryDelay: pulumi.String("60s"),
MaxEmptySearches: pulumi.Float64(10),
ChunkingConfig: &elasticstack.ElasticsearchMlDatafeedChunkingConfigArgs{
Mode: pulumi.String("manual"),
TimeSpan: pulumi.String("30m"),
},
DelayedDataCheckConfig: &elasticstack.ElasticsearchMlDatafeedDelayedDataCheckConfigArgs{
Enabled: pulumi.Bool(true),
CheckWindow: pulumi.String("2h"),
},
IndicesOptions: &elasticstack.ElasticsearchMlDatafeedIndicesOptionsArgs{
IgnoreUnavailable: pulumi.Bool(true),
AllowNoIndices: pulumi.Bool(false),
ExpandWildcards: pulumi.StringArray{
pulumi.String("open"),
pulumi.String("closed"),
},
},
RuntimeMappings: pulumi.String(json2),
ScriptFields: pulumi.String(json3),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;
return await Deployment.RunAsync(() =>
{
// Required ML Job for the datafeed
var example = new Elasticstack.Index.ElasticsearchMlAnomalyDetector("example", new()
{
JobId = "example-anomaly-job",
Description = "Example anomaly detection job",
AnalysisConfig = new[]
{
{
{ "bucketSpan", "15m" },
{ "detectors", new[]
{
{
{ "function", "count" },
},
} },
},
},
DataDescription = new[]
{
{
{ "timeField", "@timestamp" },
{ "timeFormat", "epoch_ms" },
},
},
});
// Basic ML Datafeed
var basic = new Elasticstack.ElasticsearchMlDatafeed("basic", new()
{
DatafeedId = "my-basic-datafeed",
JobId = example.JobId,
Indices = new[]
{
"log-data-*",
},
Query = JsonSerializer.Serialize(new Dictionary<string, object?>
{
["match_all"] = new Dictionary<string, object?>
{
},
}),
});
// Comprehensive ML Datafeed with all options
var comprehensive = new Elasticstack.ElasticsearchMlDatafeed("comprehensive", new()
{
DatafeedId = "my-comprehensive-datafeed",
JobId = example.JobId,
Indices = new[]
{
"app-logs-*",
"system-logs-*",
},
Query = JsonSerializer.Serialize(new Dictionary<string, object?>
{
["bool"] = new Dictionary<string, object?>
{
["must"] = new[]
{
new Dictionary<string, object?>
{
["range"] = new Dictionary<string, object?>
{
["@timestamp"] = new Dictionary<string, object?>
{
["gte"] = "now-1h",
},
},
},
new Dictionary<string, object?>
{
["term"] = new Dictionary<string, object?>
{
["status"] = "error",
},
},
},
},
}),
ScrollSize = 1000,
Frequency = "30s",
QueryDelay = "60s",
MaxEmptySearches = 10,
ChunkingConfig = new Elasticstack.Inputs.ElasticsearchMlDatafeedChunkingConfigArgs
{
Mode = "manual",
TimeSpan = "30m",
},
DelayedDataCheckConfig = new Elasticstack.Inputs.ElasticsearchMlDatafeedDelayedDataCheckConfigArgs
{
Enabled = true,
CheckWindow = "2h",
},
IndicesOptions = new Elasticstack.Inputs.ElasticsearchMlDatafeedIndicesOptionsArgs
{
IgnoreUnavailable = true,
AllowNoIndices = false,
ExpandWildcards = new[]
{
"open",
"closed",
},
},
RuntimeMappings = JsonSerializer.Serialize(new Dictionary<string, object?>
{
["hour_of_day"] = new Dictionary<string, object?>
{
["type"] = "long",
["script"] = new Dictionary<string, object?>
{
["source"] = "emit(doc['@timestamp'].value.getHour())",
},
},
}),
ScriptFields = JsonSerializer.Serialize(new Dictionary<string, object?>
{
["my_script_field"] = new Dictionary<string, object?>
{
["script"] = new Dictionary<string, object?>
{
["source"] = "_score * doc['my_field'].value",
},
},
}),
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.ElasticsearchMlAnomalyDetector;
import com.pulumi.elasticstack.ElasticsearchMlAnomalyDetectorArgs;
import com.pulumi.elasticstack.ElasticsearchMlDatafeed;
import com.pulumi.elasticstack.ElasticsearchMlDatafeedArgs;
import com.pulumi.elasticstack.inputs.ElasticsearchMlDatafeedChunkingConfigArgs;
import com.pulumi.elasticstack.inputs.ElasticsearchMlDatafeedDelayedDataCheckConfigArgs;
import com.pulumi.elasticstack.inputs.ElasticsearchMlDatafeedIndicesOptionsArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Required ML Job for the datafeed
var example = new ElasticsearchMlAnomalyDetector("example", ElasticsearchMlAnomalyDetectorArgs.builder()
.jobId("example-anomaly-job")
.description("Example anomaly detection job")
.analysisConfig(List.of(Map.ofEntries(
Map.entry("bucketSpan", "15m"),
Map.entry("detectors", List.of(Map.of("function", "count")))
)))
.dataDescription(List.of(Map.ofEntries(
Map.entry("timeField", "@timestamp"),
Map.entry("timeFormat", "epoch_ms")
)))
.build());
// Basic ML Datafeed
var basic = new ElasticsearchMlDatafeed("basic", ElasticsearchMlDatafeedArgs.builder()
.datafeedId("my-basic-datafeed")
.jobId(example.jobId())
.indices("log-data-*")
.query(serializeJson(
jsonObject(
jsonProperty("match_all", jsonObject(
))
)))
.build());
// Comprehensive ML Datafeed with all options
var comprehensive = new ElasticsearchMlDatafeed("comprehensive", ElasticsearchMlDatafeedArgs.builder()
.datafeedId("my-comprehensive-datafeed")
.jobId(example.jobId())
.indices(
"app-logs-*",
"system-logs-*")
.query(serializeJson(
jsonObject(
jsonProperty("bool", jsonObject(
jsonProperty("must", jsonArray(
jsonObject(
jsonProperty("range", jsonObject(
jsonProperty("@timestamp", jsonObject(
jsonProperty("gte", "now-1h")
))
))
),
jsonObject(
jsonProperty("term", jsonObject(
jsonProperty("status", "error")
))
)
))
))
)))
.scrollSize(1000.0)
.frequency("30s")
.queryDelay("60s")
.maxEmptySearches(10.0)
.chunkingConfig(ElasticsearchMlDatafeedChunkingConfigArgs.builder()
.mode("manual")
.timeSpan("30m")
.build())
.delayedDataCheckConfig(ElasticsearchMlDatafeedDelayedDataCheckConfigArgs.builder()
.enabled(true)
.checkWindow("2h")
.build())
.indicesOptions(ElasticsearchMlDatafeedIndicesOptionsArgs.builder()
.ignoreUnavailable(true)
.allowNoIndices(false)
.expandWildcards(
"open",
"closed")
.build())
.runtimeMappings(serializeJson(
jsonObject(
jsonProperty("hour_of_day", jsonObject(
jsonProperty("type", "long"),
jsonProperty("script", jsonObject(
jsonProperty("source", "emit(doc['@timestamp'].value.getHour())")
))
))
)))
.scriptFields(serializeJson(
jsonObject(
jsonProperty("my_script_field", jsonObject(
jsonProperty("script", jsonObject(
jsonProperty("source", "_score * doc['my_field'].value")
))
))
)))
.build());
}
}
resources:
# Basic ML Datafeed
basic:
type: elasticstack:ElasticsearchMlDatafeed
properties:
datafeedId: my-basic-datafeed
jobId: ${example.jobId}
indices:
- log-data-*
query:
fn::toJSON:
match_all: {}
# Comprehensive ML Datafeed with all options
comprehensive:
type: elasticstack:ElasticsearchMlDatafeed
properties:
datafeedId: my-comprehensive-datafeed
jobId: ${example.jobId}
indices:
- app-logs-*
- system-logs-*
query:
fn::toJSON:
bool:
must:
- range:
'@timestamp':
gte: now-1h
- term:
status: error
scrollSize: 1000
frequency: 30s
queryDelay: 60s
maxEmptySearches: 10
chunkingConfig:
mode: manual
timeSpan: 30m
delayedDataCheckConfig:
enabled: true
checkWindow: 2h
indicesOptions:
ignoreUnavailable: true
allowNoIndices: false
expandWildcards:
- open
- closed
runtimeMappings:
fn::toJSON:
hour_of_day:
type: long
script:
source: emit(doc['@timestamp'].value.getHour())
scriptFields:
fn::toJSON:
my_script_field:
script:
source: _score * doc['my_field'].value
# Required ML Job for the datafeed
example:
type: elasticstack:ElasticsearchMlAnomalyDetector
properties:
jobId: example-anomaly-job
description: Example anomaly detection job
analysisConfig:
- bucketSpan: 15m
detectors:
- function: count
dataDescription:
- timeField: '@timestamp'
timeFormat: epoch_ms
Create ElasticsearchMlDatafeed Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ElasticsearchMlDatafeed(name: string, args: ElasticsearchMlDatafeedArgs, opts?: CustomResourceOptions);@overload
def ElasticsearchMlDatafeed(resource_name: str,
args: ElasticsearchMlDatafeedArgs,
opts: Optional[ResourceOptions] = None)
@overload
def ElasticsearchMlDatafeed(resource_name: str,
opts: Optional[ResourceOptions] = None,
indices: Optional[Sequence[str]] = None,
job_id: Optional[str] = None,
datafeed_id: Optional[str] = None,
delayed_data_check_config: Optional[ElasticsearchMlDatafeedDelayedDataCheckConfigArgs] = None,
elasticsearch_connections: Optional[Sequence[ElasticsearchMlDatafeedElasticsearchConnectionArgs]] = None,
frequency: Optional[str] = None,
aggregations: Optional[str] = None,
indices_options: Optional[ElasticsearchMlDatafeedIndicesOptionsArgs] = None,
chunking_config: Optional[ElasticsearchMlDatafeedChunkingConfigArgs] = None,
max_empty_searches: Optional[float] = None,
query: Optional[str] = None,
query_delay: Optional[str] = None,
runtime_mappings: Optional[str] = None,
script_fields: Optional[str] = None,
scroll_size: Optional[float] = None)func NewElasticsearchMlDatafeed(ctx *Context, name string, args ElasticsearchMlDatafeedArgs, opts ...ResourceOption) (*ElasticsearchMlDatafeed, error)public ElasticsearchMlDatafeed(string name, ElasticsearchMlDatafeedArgs args, CustomResourceOptions? opts = null)
public ElasticsearchMlDatafeed(String name, ElasticsearchMlDatafeedArgs args)
public ElasticsearchMlDatafeed(String name, ElasticsearchMlDatafeedArgs args, CustomResourceOptions options)
type: elasticstack:ElasticsearchMlDatafeed
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args ElasticsearchMlDatafeedArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ElasticsearchMlDatafeedArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ElasticsearchMlDatafeedArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ElasticsearchMlDatafeedArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ElasticsearchMlDatafeedArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var elasticsearchMlDatafeedResource = new Elasticstack.ElasticsearchMlDatafeed("elasticsearchMlDatafeedResource", new()
{
Indices = new[]
{
"string",
},
JobId = "string",
DatafeedId = "string",
DelayedDataCheckConfig = new Elasticstack.Inputs.ElasticsearchMlDatafeedDelayedDataCheckConfigArgs
{
Enabled = false,
CheckWindow = "string",
},
Frequency = "string",
Aggregations = "string",
IndicesOptions = new Elasticstack.Inputs.ElasticsearchMlDatafeedIndicesOptionsArgs
{
AllowNoIndices = false,
ExpandWildcards = new[]
{
"string",
},
IgnoreUnavailable = false,
},
ChunkingConfig = new Elasticstack.Inputs.ElasticsearchMlDatafeedChunkingConfigArgs
{
Mode = "string",
TimeSpan = "string",
},
MaxEmptySearches = 0,
Query = "string",
QueryDelay = "string",
RuntimeMappings = "string",
ScriptFields = "string",
ScrollSize = 0,
});
example, err := elasticstack.NewElasticsearchMlDatafeed(ctx, "elasticsearchMlDatafeedResource", &elasticstack.ElasticsearchMlDatafeedArgs{
Indices: pulumi.StringArray{
pulumi.String("string"),
},
JobId: pulumi.String("string"),
DatafeedId: pulumi.String("string"),
DelayedDataCheckConfig: &elasticstack.ElasticsearchMlDatafeedDelayedDataCheckConfigArgs{
Enabled: pulumi.Bool(false),
CheckWindow: pulumi.String("string"),
},
Frequency: pulumi.String("string"),
Aggregations: pulumi.String("string"),
IndicesOptions: &elasticstack.ElasticsearchMlDatafeedIndicesOptionsArgs{
AllowNoIndices: pulumi.Bool(false),
ExpandWildcards: pulumi.StringArray{
pulumi.String("string"),
},
IgnoreUnavailable: pulumi.Bool(false),
},
ChunkingConfig: &elasticstack.ElasticsearchMlDatafeedChunkingConfigArgs{
Mode: pulumi.String("string"),
TimeSpan: pulumi.String("string"),
},
MaxEmptySearches: pulumi.Float64(0),
Query: pulumi.String("string"),
QueryDelay: pulumi.String("string"),
RuntimeMappings: pulumi.String("string"),
ScriptFields: pulumi.String("string"),
ScrollSize: pulumi.Float64(0),
})
var elasticsearchMlDatafeedResource = new ElasticsearchMlDatafeed("elasticsearchMlDatafeedResource", ElasticsearchMlDatafeedArgs.builder()
.indices("string")
.jobId("string")
.datafeedId("string")
.delayedDataCheckConfig(ElasticsearchMlDatafeedDelayedDataCheckConfigArgs.builder()
.enabled(false)
.checkWindow("string")
.build())
.frequency("string")
.aggregations("string")
.indicesOptions(ElasticsearchMlDatafeedIndicesOptionsArgs.builder()
.allowNoIndices(false)
.expandWildcards("string")
.ignoreUnavailable(false)
.build())
.chunkingConfig(ElasticsearchMlDatafeedChunkingConfigArgs.builder()
.mode("string")
.timeSpan("string")
.build())
.maxEmptySearches(0.0)
.query("string")
.queryDelay("string")
.runtimeMappings("string")
.scriptFields("string")
.scrollSize(0.0)
.build());
elasticsearch_ml_datafeed_resource = elasticstack.ElasticsearchMlDatafeed("elasticsearchMlDatafeedResource",
indices=["string"],
job_id="string",
datafeed_id="string",
delayed_data_check_config={
"enabled": False,
"check_window": "string",
},
frequency="string",
aggregations="string",
indices_options={
"allow_no_indices": False,
"expand_wildcards": ["string"],
"ignore_unavailable": False,
},
chunking_config={
"mode": "string",
"time_span": "string",
},
max_empty_searches=0,
query="string",
query_delay="string",
runtime_mappings="string",
script_fields="string",
scroll_size=0)
const elasticsearchMlDatafeedResource = new elasticstack.ElasticsearchMlDatafeed("elasticsearchMlDatafeedResource", {
indices: ["string"],
jobId: "string",
datafeedId: "string",
delayedDataCheckConfig: {
enabled: false,
checkWindow: "string",
},
frequency: "string",
aggregations: "string",
indicesOptions: {
allowNoIndices: false,
expandWildcards: ["string"],
ignoreUnavailable: false,
},
chunkingConfig: {
mode: "string",
timeSpan: "string",
},
maxEmptySearches: 0,
query: "string",
queryDelay: "string",
runtimeMappings: "string",
scriptFields: "string",
scrollSize: 0,
});
type: elasticstack:ElasticsearchMlDatafeed
properties:
aggregations: string
chunkingConfig:
mode: string
timeSpan: string
datafeedId: string
delayedDataCheckConfig:
checkWindow: string
enabled: false
frequency: string
indices:
- string
indicesOptions:
allowNoIndices: false
expandWildcards:
- string
ignoreUnavailable: false
jobId: string
maxEmptySearches: 0
query: string
queryDelay: string
runtimeMappings: string
scriptFields: string
scrollSize: 0
ElasticsearchMlDatafeed Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ElasticsearchMlDatafeed resource accepts the following input properties:
- Datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- Indices List<string>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - Job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- Aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- Chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- Delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - Elasticsearch
Connections List<ElasticsearchMl Datafeed Elasticsearch Connection> - Elasticsearch connection configuration block.
- Frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - Indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- Max
Empty doubleSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - Query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - Query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - Runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- Script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- Scroll
Size double - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- Datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- Indices []string
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - Job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- Aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- Chunking
Config ElasticsearchMl Datafeed Chunking Config Args - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- Delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config Args - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - Elasticsearch
Connections []ElasticsearchMl Datafeed Elasticsearch Connection Args - Elasticsearch connection configuration block.
- Frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - Indices
Options ElasticsearchMl Datafeed Indices Options Args - Specifies index expansion options that are used during search.
- Max
Empty float64Searches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - Query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - Query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - Runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- Script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- Scroll
Size float64 - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- datafeed
Id String - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- indices List<String>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - job
Id String - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- aggregations String
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections List<ElasticsearchMl Datafeed Elasticsearch Connection> - Elasticsearch connection configuration block.
- frequency String
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- max
Empty DoubleSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query String
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay String - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings String - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields String - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size Double - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- indices string[]
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections ElasticsearchMl Datafeed Elasticsearch Connection[] - Elasticsearch connection configuration block.
- frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- max
Empty numberSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size number - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- datafeed_
id str - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- indices Sequence[str]
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - job_
id str - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- aggregations str
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking_
config ElasticsearchMl Datafeed Chunking Config Args - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- delayed_
data_ Elasticsearchcheck_ config Ml Datafeed Delayed Data Check Config Args - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch_
connections Sequence[ElasticsearchMl Datafeed Elasticsearch Connection Args] - Elasticsearch connection configuration block.
- frequency str
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices_
options ElasticsearchMl Datafeed Indices Options Args - Specifies index expansion options that are used during search.
- max_
empty_ floatsearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query str
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query_
delay str - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime_
mappings str - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script_
fields str - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll_
size float - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- datafeed
Id String - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- indices List<String>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - job
Id String - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- aggregations String
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config Property Map - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- delayed
Data Property MapCheck Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections List<Property Map> - Elasticsearch connection configuration block.
- frequency String
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices
Options Property Map - Specifies index expansion options that are used during search.
- max
Empty NumberSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query String
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay String - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings String - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields String - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size Number - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
Outputs
All input properties are implicitly available as output properties. Additionally, the ElasticsearchMlDatafeed resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing ElasticsearchMlDatafeed Resource
Get an existing ElasticsearchMlDatafeed resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ElasticsearchMlDatafeedState, opts?: CustomResourceOptions): ElasticsearchMlDatafeed@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
aggregations: Optional[str] = None,
chunking_config: Optional[ElasticsearchMlDatafeedChunkingConfigArgs] = None,
datafeed_id: Optional[str] = None,
delayed_data_check_config: Optional[ElasticsearchMlDatafeedDelayedDataCheckConfigArgs] = None,
elasticsearch_connections: Optional[Sequence[ElasticsearchMlDatafeedElasticsearchConnectionArgs]] = None,
frequency: Optional[str] = None,
indices: Optional[Sequence[str]] = None,
indices_options: Optional[ElasticsearchMlDatafeedIndicesOptionsArgs] = None,
job_id: Optional[str] = None,
max_empty_searches: Optional[float] = None,
query: Optional[str] = None,
query_delay: Optional[str] = None,
runtime_mappings: Optional[str] = None,
script_fields: Optional[str] = None,
scroll_size: Optional[float] = None) -> ElasticsearchMlDatafeedfunc GetElasticsearchMlDatafeed(ctx *Context, name string, id IDInput, state *ElasticsearchMlDatafeedState, opts ...ResourceOption) (*ElasticsearchMlDatafeed, error)public static ElasticsearchMlDatafeed Get(string name, Input<string> id, ElasticsearchMlDatafeedState? state, CustomResourceOptions? opts = null)public static ElasticsearchMlDatafeed get(String name, Output<String> id, ElasticsearchMlDatafeedState state, CustomResourceOptions options)resources: _: type: elasticstack:ElasticsearchMlDatafeed get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- Chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- Datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- Delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - Elasticsearch
Connections List<ElasticsearchMl Datafeed Elasticsearch Connection> - Elasticsearch connection configuration block.
- Frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - Indices List<string>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - Indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- Job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- Max
Empty doubleSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - Query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - Query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - Runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- Script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- Scroll
Size double - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- Aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- Chunking
Config ElasticsearchMl Datafeed Chunking Config Args - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- Datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- Delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config Args - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - Elasticsearch
Connections []ElasticsearchMl Datafeed Elasticsearch Connection Args - Elasticsearch connection configuration block.
- Frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - Indices []string
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - Indices
Options ElasticsearchMl Datafeed Indices Options Args - Specifies index expansion options that are used during search.
- Job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- Max
Empty float64Searches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - Query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - Query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - Runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- Script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- Scroll
Size float64 - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- aggregations String
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- datafeed
Id String - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections List<ElasticsearchMl Datafeed Elasticsearch Connection> - Elasticsearch connection configuration block.
- frequency String
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices List<String>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- job
Id String - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- max
Empty DoubleSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query String
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay String - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings String - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields String - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size Double - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- aggregations string
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config ElasticsearchMl Datafeed Chunking Config - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- datafeed
Id string - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- delayed
Data ElasticsearchCheck Config Ml Datafeed Delayed Data Check Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections ElasticsearchMl Datafeed Elasticsearch Connection[] - Elasticsearch connection configuration block.
- frequency string
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices string[]
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - indices
Options ElasticsearchMl Datafeed Indices Options - Specifies index expansion options that are used during search.
- job
Id string - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- max
Empty numberSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query string
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay string - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings string - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields string - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size number - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- aggregations str
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking_
config ElasticsearchMl Datafeed Chunking Config Args - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- datafeed_
id str - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- delayed_
data_ Elasticsearchcheck_ config Ml Datafeed Delayed Data Check Config Args - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch_
connections Sequence[ElasticsearchMl Datafeed Elasticsearch Connection Args] - Elasticsearch connection configuration block.
- frequency str
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices Sequence[str]
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - indices_
options ElasticsearchMl Datafeed Indices Options Args - Specifies index expansion options that are used during search.
- job_
id str - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- max_
empty_ floatsearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query str
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query_
delay str - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime_
mappings str - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script_
fields str - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll_
size float - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
- aggregations String
- If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. This should be a JSON object representing the aggregations to be performed.
- chunking
Config Property Map - Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.
- datafeed
Id String - A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.
- delayed
Data Property MapCheck Config - Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the
query_delayis set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. - elasticsearch
Connections List<Property Map> - Elasticsearch connection configuration block.
- frequency String
- The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When
frequencyis shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation. - indices List<String>
- An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the
remote_cluster_clientrole. - indices
Options Property Map - Specifies index expansion options that are used during search.
- job
Id String - Identifier for the anomaly detection job. The job must exist before creating the datafeed.
- max
Empty NumberSearches - If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after
frequencytimesmax_empty_searchesof real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. - query String
- The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. By default uses
{<span pulumi-lang-nodejs=""matchAll"" pulumi-lang-dotnet=""MatchAll"" pulumi-lang-go=""matchAll"" pulumi-lang-python=""match_all"" pulumi-lang-yaml=""matchAll"" pulumi-lang-java=""matchAll"">"match_all"</span>: {"boost": 1}}. - query
Delay String - The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between
60sand120s. This randomness improves the query performance when there are multiple jobs running on the same node. - runtime
Mappings String - Specifies runtime fields for the datafeed search. This should be a JSON object representing the runtime field mappings.
- script
Fields String - Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. This should be a JSON object representing the script fields.
- scroll
Size Number - The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of
index.max_result_window, which is 10,000 by default.
Supporting Types
ElasticsearchMlDatafeedChunkingConfig, ElasticsearchMlDatafeedChunkingConfigArgs
- Mode string
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - Time
Span string - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
- Mode string
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - Time
Span string - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
- mode String
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - time
Span String - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
- mode string
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - time
Span string - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
- mode str
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - time_
span str - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
- mode String
- The chunking mode. Can be
auto,manual, oroff. Inautomode, the chunk size is dynamically calculated. Inmanualmode, chunking is applied according to the specifiedtime_span. Inoffmode, no chunking is applied. - time
Span String - The time span for each chunk. Only applicable and required when mode is
manual. Must be a valid duration.
ElasticsearchMlDatafeedDelayedDataCheckConfig, ElasticsearchMlDatafeedDelayedDataCheckConfigArgs
- Enabled bool
- Specifies whether the datafeed periodically checks for delayed data.
- Check
Window string - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
- Enabled bool
- Specifies whether the datafeed periodically checks for delayed data.
- Check
Window string - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
- enabled Boolean
- Specifies whether the datafeed periodically checks for delayed data.
- check
Window String - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
- enabled boolean
- Specifies whether the datafeed periodically checks for delayed data.
- check
Window string - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
- enabled bool
- Specifies whether the datafeed periodically checks for delayed data.
- check_
window str - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
- enabled Boolean
- Specifies whether the datafeed periodically checks for delayed data.
- check
Window String - The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate
check_windowto be calculated when the real-time datafeed runs.
ElasticsearchMlDatafeedElasticsearchConnection, ElasticsearchMlDatafeedElasticsearchConnectionArgs
- Api
Key string - API Key to use for authentication to Elasticsearch
- Bearer
Token string - Bearer Token to use for authentication to Elasticsearch
- Ca
Data string - PEM-encoded custom Certificate Authority certificate
- Ca
File string - Path to a custom Certificate Authority certificate
- Cert
Data string - PEM encoded certificate for client auth
- Cert
File string - Path to a file containing the PEM encoded certificate for client auth
- Endpoints List<string>
- Es
Client stringAuthentication - ES Client Authentication field to be used with the JWT token
- Headers Dictionary<string, string>
- A list of headers to be sent with each request to Elasticsearch.
- Insecure bool
- Disable TLS certificate validation
- Key
Data string - PEM encoded private key for client auth
- Key
File string - Path to a file containing the PEM encoded private key for client auth
- Password string
- Password to use for API authentication to Elasticsearch.
- Username string
- Username to use for API authentication to Elasticsearch.
- Api
Key string - API Key to use for authentication to Elasticsearch
- Bearer
Token string - Bearer Token to use for authentication to Elasticsearch
- Ca
Data string - PEM-encoded custom Certificate Authority certificate
- Ca
File string - Path to a custom Certificate Authority certificate
- Cert
Data string - PEM encoded certificate for client auth
- Cert
File string - Path to a file containing the PEM encoded certificate for client auth
- Endpoints []string
- Es
Client stringAuthentication - ES Client Authentication field to be used with the JWT token
- Headers map[string]string
- A list of headers to be sent with each request to Elasticsearch.
- Insecure bool
- Disable TLS certificate validation
- Key
Data string - PEM encoded private key for client auth
- Key
File string - Path to a file containing the PEM encoded private key for client auth
- Password string
- Password to use for API authentication to Elasticsearch.
- Username string
- Username to use for API authentication to Elasticsearch.
- api
Key String - API Key to use for authentication to Elasticsearch
- bearer
Token String - Bearer Token to use for authentication to Elasticsearch
- ca
Data String - PEM-encoded custom Certificate Authority certificate
- ca
File String - Path to a custom Certificate Authority certificate
- cert
Data String - PEM encoded certificate for client auth
- cert
File String - Path to a file containing the PEM encoded certificate for client auth
- endpoints List<String>
- es
Client StringAuthentication - ES Client Authentication field to be used with the JWT token
- headers Map<String,String>
- A list of headers to be sent with each request to Elasticsearch.
- insecure Boolean
- Disable TLS certificate validation
- key
Data String - PEM encoded private key for client auth
- key
File String - Path to a file containing the PEM encoded private key for client auth
- password String
- Password to use for API authentication to Elasticsearch.
- username String
- Username to use for API authentication to Elasticsearch.
- api
Key string - API Key to use for authentication to Elasticsearch
- bearer
Token string - Bearer Token to use for authentication to Elasticsearch
- ca
Data string - PEM-encoded custom Certificate Authority certificate
- ca
File string - Path to a custom Certificate Authority certificate
- cert
Data string - PEM encoded certificate for client auth
- cert
File string - Path to a file containing the PEM encoded certificate for client auth
- endpoints string[]
- es
Client stringAuthentication - ES Client Authentication field to be used with the JWT token
- headers {[key: string]: string}
- A list of headers to be sent with each request to Elasticsearch.
- insecure boolean
- Disable TLS certificate validation
- key
Data string - PEM encoded private key for client auth
- key
File string - Path to a file containing the PEM encoded private key for client auth
- password string
- Password to use for API authentication to Elasticsearch.
- username string
- Username to use for API authentication to Elasticsearch.
- api_
key str - API Key to use for authentication to Elasticsearch
- bearer_
token str - Bearer Token to use for authentication to Elasticsearch
- ca_
data str - PEM-encoded custom Certificate Authority certificate
- ca_
file str - Path to a custom Certificate Authority certificate
- cert_
data str - PEM encoded certificate for client auth
- cert_
file str - Path to a file containing the PEM encoded certificate for client auth
- endpoints Sequence[str]
- es_
client_ strauthentication - ES Client Authentication field to be used with the JWT token
- headers Mapping[str, str]
- A list of headers to be sent with each request to Elasticsearch.
- insecure bool
- Disable TLS certificate validation
- key_
data str - PEM encoded private key for client auth
- key_
file str - Path to a file containing the PEM encoded private key for client auth
- password str
- Password to use for API authentication to Elasticsearch.
- username str
- Username to use for API authentication to Elasticsearch.
- api
Key String - API Key to use for authentication to Elasticsearch
- bearer
Token String - Bearer Token to use for authentication to Elasticsearch
- ca
Data String - PEM-encoded custom Certificate Authority certificate
- ca
File String - Path to a custom Certificate Authority certificate
- cert
Data String - PEM encoded certificate for client auth
- cert
File String - Path to a file containing the PEM encoded certificate for client auth
- endpoints List<String>
- es
Client StringAuthentication - ES Client Authentication field to be used with the JWT token
- headers Map<String>
- A list of headers to be sent with each request to Elasticsearch.
- insecure Boolean
- Disable TLS certificate validation
- key
Data String - PEM encoded private key for client auth
- key
File String - Path to a file containing the PEM encoded private key for client auth
- password String
- Password to use for API authentication to Elasticsearch.
- username String
- Username to use for API authentication to Elasticsearch.
ElasticsearchMlDatafeedIndicesOptions, ElasticsearchMlDatafeedIndicesOptionsArgs
- Allow
No boolIndices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - Expand
Wildcards List<string> - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- Ignore
Throttled bool - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- bool
- If true, unavailable indices (missing or closed) are ignored.
- Allow
No boolIndices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - Expand
Wildcards []string - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- Ignore
Throttled bool - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- bool
- If true, unavailable indices (missing or closed) are ignored.
- allow
No BooleanIndices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - expand
Wildcards List<String> - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- ignore
Throttled Boolean - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- Boolean
- If true, unavailable indices (missing or closed) are ignored.
- allow
No booleanIndices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - expand
Wildcards string[] - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- ignore
Throttled boolean - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- boolean
- If true, unavailable indices (missing or closed) are ignored.
- allow_
no_ boolindices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - expand_
wildcards Sequence[str] - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- ignore_
throttled bool - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- bool
- If true, unavailable indices (missing or closed) are ignored.
- allow
No BooleanIndices - If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the
_allstring or when no indices are specified. - expand
Wildcards List<String> - Type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. Supports comma-separated values.
- ignore
Throttled Boolean - If true, concrete, expanded, or aliased indices are ignored when frozen. This setting is deprecated.
- Boolean
- If true, unavailable indices (missing or closed) are ignored.
Package Details
- Repository
- elasticstack elastic/terraform-provider-elasticstack
- License
- Notes
- This Pulumi package is based on the
elasticstackTerraform Provider.
elasticstack 0.13.1 published on Thursday, Dec 11, 2025 by elastic
