Elastic Stack (ELK Stack) Rollup API

openapi: 3.2.0
info:
  title: Elasticsearch Request & Response Specification Rollup API
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
tags:
- name: rollup
paths:
  /_rollup/job/{id}:
    get:
      tags:
      - rollup
      summary: Get rollup job information
      description: 'Get the configuration, stats, and status of rollup jobs.


        NOTE: This API returns only active (both `STARTED` and `STOPPED`) jobs.

        If a job was created, ran for a while, then was deleted, the API does not return any details about it.

        For details about a historical rollup job, the rollup capabilities API may be more useful.


        ## Required authorization


        * Cluster privileges: `monitor_rollup`

        '
      operationId: rollup-get-jobs
      parameters:
      - $ref: '#/components/parameters/rollup.get_jobs-id'
      responses:
        '200':
          $ref: '#/components/responses/rollup.get_jobs-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    put:
      tags:
      - rollup
      summary: Create a rollup job
      description: 'WARNING: From 8.15.0, calling this API in a cluster with no rollup usage will fail with a message about the deprecation and planned removal of rollup features. A cluster needs to contain either a rollup job or a rollup index in order for this API to be allowed to run.


        The rollup job configuration contains all the details about how the job should run, when it indexes documents, and what future queries will be able to run against the rollup index.


        There are three main sections to the job configuration: the logistical details about the job (for example, the cron schedule), the fields that are used for grouping, and what metrics to collect for each group.


        Jobs are created in a `STOPPED` state. You can start them with the start rollup jobs API.


        ## Required authorization


        * Cluster privileges: `manage`,`manage_rollup`

        '
      operationId: rollup-put-job
      parameters:
      - in: path
        name: id
        description: 'Identifier for the rollup job. This can be any alphanumeric string and uniquely identifies the

          data that is associated with the rollup job. The ID is persistent; it is stored with the rolled

          up data. If you create a job, let it run for a while, then delete the job, the data that the job

          rolled up is still be associated with this job ID. You cannot create a new job with the same ID

          since that could lead to problems with mismatched job configurations.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                cron:
                  description: 'A cron string which defines the intervals when the rollup job should be executed. When the interval

                    triggers, the indexer attempts to rollup the data in the index pattern. The cron pattern is unrelated

                    to the time interval of the data being rolled up. For example, you may wish to create hourly rollups

                    of your document but to only run the indexer on a daily basis at midnight, as defined by the cron. The

                    cron pattern is defined just like a Watcher cron schedule.'
                  type: string
                groups:
                  description: 'Defines the grouping fields and aggregations that are defined for this rollup job. These fields will then be

                    available later for aggregating into buckets. These aggs and fields can be used in any combination. Think of

                    the groups configuration as defining a set of tools that can later be used in aggregations to partition the

                    data. Unlike raw data, we have to think ahead to which fields and aggregations might be used. Rollups provide

                    enough flexibility that you simply need to determine which fields are needed, not in what order they are needed.'
                  allOf:
                  - $ref: '#/components/schemas/rollup._types.Groupings'
                index_pattern:
                  description: 'The index or index pattern to roll up. Supports wildcard-style patterns (`logstash-*`). The job attempts to

                    rollup the entire index or index-pattern.'
                  type: string
                metrics:
                  description: 'Defines the metrics to collect for each grouping tuple. By default, only the doc_counts are collected for each

                    group. To make rollup useful, you will often add metrics like averages, mins, maxes, etc. Metrics are defined

                    on a per-field basis and for each field you configure which metric should be collected.'
                  type: array
                  items:
                    $ref: '#/components/schemas/rollup._types.FieldMetric'
                page_size:
                  description: 'The number of bucket results that are processed on each iteration of the rollup indexer. A larger value tends

                    to execute faster, but requires more memory during processing. This value has no effect on how the data is

                    rolled up; it is merely used for tweaking the speed or memory cost of the indexer.'
                  type: number
                rollup_index:
                  description: The index that contains the rollup results. The index can be shared with other rollup jobs. The data is stored so that it doesn’t interfere with unrelated jobs.
                  allOf:
                  - $ref: '#/components/schemas/_types.IndexName'
                timeout:
                  description: Time to wait for the request to complete.
                  default: 20s
                  allOf:
                  - $ref: '#/components/schemas/_types.Duration'
                headers:
                  allOf:
                  - $ref: '#/components/schemas/_types.HttpHeaders'
              required:
              - cron
              - groups
              - index_pattern
              - page_size
              - rollup_index
            examples:
              CreateRollupJobRequestExample1:
                description: 'Run `PUT _rollup/job/sensor` to create a rollup job that targets the `sensor-*` index pattern. This configuration enables date histograms to be used on the `timestamp` field and terms aggregations to be used on the `node` field. This configuration defines metrics over two fields: `temperature` and `voltage`. For the `temperature` field, it collects the `min`, `max`, and `sum` of the temperature. For `voltage`, it collects the `average`.

                  '
                value: "{\n  \"index_pattern\": \"sensor-*\",\n  \"rollup_index\": \"sensor_rollup\",\n  \"cron\": \"*/30 * * * * ?\",\n  \"page_size\": 1000,\n  \"groups\": {\n    \"date_histogram\": {\n      \"field\": \"timestamp\",\n      \"fixed_interval\": \"1h\",\n      \"delay\": \"7d\"\n    },\n    \"terms\": {\n      \"fields\": [ \"node\" ]\n    }\n  },\n  \"metrics\": [\n      {\n      \"field\": \"temperature\",\n      \"metrics\": [ \"min\", \"max\", \"sum\" ]\n    },\n    {\n      \"field\": \"voltage\",\n      \"metrics\": [ \"avg\" ]\n    }\n  ]\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                CreateRollupJobResponseExample1:
                  value: "{\n  \"acknowledged\": true\n}"
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    delete:
      tags:
      - rollup
      summary: Delete a rollup job
      description: "A job must be stopped before it can be deleted.\nIf you attempt to delete a started job, an error occurs.\nSimilarly, if you attempt to delete a nonexistent job, an exception occurs.\n\nIMPORTANT: When you delete a job, you remove only the process that is actively monitoring and rolling up data.\nThe API does not delete any previously rolled up data.\nThis is by design; a user may wish to roll up a static data set.\nBecause the data set is static, after it has been fully rolled up there is no need to keep the indexing rollup job around (as there will be no new data).\nThus the job can be deleted, leaving behind the rolled up data for analysis.\nIf you wish to also remove the rollup data and the rollup index contains the data for only a single job, you can delete the whole rollup index.\nIf the rollup index stores data from several jobs, you must issue a delete-by-query that targets the rollup job's identifier in the rollup index. For example:\n\n```\nPOST my_rollup_index/_delete_by_query\n{\n  \"query\": {\n    \"term\": {\n      \"_rollup.id\": \"the_rollup_job_id\"\n    }\n  }\n}\n```\n\n## Required authorization\n\n* Cluster privileges: `manage_rollup`\n"
      operationId: rollup-delete-job
      parameters:
      - in: path
        name: id
        description: Identifier for the job.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                  task_failures:
                    type: array
                    items:
                      $ref: '#/components/schemas/_types.TaskFailure'
                required:
                - acknowledged
              examples:
                DeleteRollupJobResponseExample1:
                  description: A successful response from `DELETE _rollup/job/sensor`.
                  value: "{\n  \"acknowledged\": true\n}"
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_rollup/job:
    get:
      tags:
      - rollup
      summary: Get rollup job information
      description: 'Get the configuration, stats, and status of rollup jobs.


        NOTE: This API returns only active (both `STARTED` and `STOPPED`) jobs.

        If a job was created, ran for a while, then was deleted, the API does not return any details about it.

        For details about a historical rollup job, the rollup capabilities API may be more useful.


        ## Required authorization


        * Cluster privileges: `monitor_rollup`

        '
      operationId: rollup-get-jobs-1
      responses:
        '200':
          $ref: '#/components/responses/rollup.get_jobs-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_rollup/data/{id}:
    get:
      tags:
      - rollup
      summary: Get the rollup job capabilities
      description: 'Get the capabilities of any rollup jobs that have been configured for a specific index or index pattern.


        This API is useful because a rollup job is often configured to rollup only a subset of fields from the source index.

        Furthermore, only certain aggregations can be configured for various fields, leading to a limited subset of functionality depending on that configuration.

        This API enables you to inspect an index and determine:


        1. Does this index have associated rollup data somewhere in the cluster?

        2. If yes to the first question, what fields were rolled up, what aggregations can be performed, and where does the data live?


        ## Required authorization


        * Cluster privileges: `monitor_rollup`

        '
      operationId: rollup-get-rollup-caps
      parameters:
      - $ref: '#/components/parameters/rollup.get_rollup_caps-id'
      responses:
        '200':
          $ref: '#/components/responses/rollup.get_rollup_caps-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_rollup/data:
    get:
      tags:
      - rollup
      summary: Get the rollup job capabilities
      description: 'Get the capabilities of any rollup jobs that have been configured for a specific index or index pattern.


        This API is useful because a rollup job is often configured to rollup only a subset of fields from the source index.

        Furthermore, only certain aggregations can be configured for various fields, leading to a limited subset of functionality depending on that configuration.

        This API enables you to inspect an index and determine:


        1. Does this index have associated rollup data somewhere in the cluster?

        2. If yes to the first question, what fields were rolled up, what aggregations can be performed, and where does the data live?


        ## Required authorization


        * Cluster privileges: `monitor_rollup`

        '
      operationId: rollup-get-rollup-caps-1
      responses:
        '200':
          $ref: '#/components/responses/rollup.get_rollup_caps-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /{index}/_rollup/data:
    get:
      tags:
      - rollup
      summary: Get the rollup index capabilities
      description: 'Get the rollup capabilities of all jobs inside of a rollup index.

        A single rollup index may store the data for multiple rollup jobs and may have a variety of capabilities depending on those jobs. This API enables you to determine:


        * What jobs are stored in an index (or indices specified via a pattern)?

        * What target indices were rolled up, what fields were used in those rollups, and what aggregations can be performed on each job?


        ## Required authorization


        * Index privileges: `read`

        '
      operationId: rollup-get-rollup-index-caps
      parameters:
      - in: path
        name: index
        description: 'Data stream or index to check for rollup capabilities.

          Wildcard (`*`) expressions are supported.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Ids'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/rollup.get_rollup_index_caps.IndexCapabilities'
              examples:
                GetRollupIndexCapabilitiesResponseExample1:
                  description: 'A successful response from `GET /sensor_rollup/_rollup/data`. The response contains the rollup job ID, the index that holds the rolled data, and the index pattern that the job was targeting. It also shows a list of fields that contain data eligible for rollup searches. For example, you can use a `min`, `max`, or `sum` aggregation on the `temperature` field, but only a `date_histogram` on `timestamp`.

                    '
                  value: "{\n  \"sensor_rollup\" : {\n    \"rollup_jobs\" : [\n      {\n        \"job_id\" : \"sensor\",\n        \"rollup_index\" : \"sensor_rollup\",\n        \"index_pattern\" : \"sensor-*\",\n        \"fields\" : {\n          \"node\" : [\n            {\n              \"agg\" : \"terms\"\n            }\n          ],\n          \"temperature\" : [\n            {\n              \"agg\" : \"min\"\n            },\n            {\n              \"agg\" : \"max\"\n            },\n            {\n              \"agg\" : \"sum\"\n            }\n          ],\n          \"timestamp\" : [\n            {\n              \"agg\" : \"date_histogram\",\n              \"time_zone\" : \"UTC\",\n              \"fixed_interval\" : \"1h\",\n              \"delay\": \"7d\"\n            }\n          ],\n          \"voltage\" : [\n            {\n              \"agg\" : \"avg\"\n            }\n          ]\n        }\n      }\n    ]\n  }\n}"
      deprecated: true
      x-state: Experimental; Added in 6.4.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /{index}/_rollup_search:
    get:
      tags:
      - rollup
      summary: Search rolled-up data
      description: 'The rollup search endpoint is needed because, internally, rolled-up documents utilize a different document structure than the original data.

        It rewrites standard Query DSL into a format that matches the rollup documents then takes the response and rewrites it back to what a client would expect given the original query.


        The request body supports a subset of features from the regular search API.

        The following functionality is not available:


        `size`: Because rollups work on pre-aggregated data, no search hits can be returned and so size must be set to zero or omitted entirely.

        `highlighter`, `suggestors`, `post_filter`, `profile`, `explain`: These are similarly disallowed.


        For more detailed examples of using the rollup search API, including querying rolled-up data only or combining rolled-up and live data, refer to the External documentation.'
      externalDocs:
        description: Getting started with rollups
        url: https://www.elastic.co/docs/manage-data/lifecycle/rollup/getting-started-api#historical-only-search-example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/rollup-search.html
      operationId: rollup-rollup-search
      parameters:
      - $ref: '#/components/parameters/rollup.rollup_search-index'
      - $ref: '#/components/parameters/rollup.rollup_search-rest_total_hits_as_int'
      - $ref: '#/components/parameters/rollup.rollup_search-typed_keys'
      requestBody:
        $ref: '#/components/requestBodies/rollup.rollup_search'
      responses:
        '200':
          $ref: '#/components/responses/rollup.rollup_search-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
    post:
      tags:
      - rollup
      summary: Search rolled-up data
      description: 'The rollup search endpoint is needed because, internally, rolled-up documents utilize a different document structure than the original data.

        It rewrites standard Query DSL into a format that matches the rollup documents then takes the response and rewrites it back to what a client would expect given the original query.


        The request body supports a subset of features from the regular search API.

        The following functionality is not available:


        `size`: Because rollups work on pre-aggregated data, no search hits can be returned and so size must be set to zero or omitted entirely.

        `highlighter`, `suggestors`, `post_filter`, `profile`, `explain`: These are similarly disallowed.


        For more detailed examples of using the rollup search API, including querying rolled-up data only or combining rolled-up and live data, refer to the External documentation.'
      externalDocs:
        description: Getting started with rollups
        url: https://www.elastic.co/docs/manage-data/lifecycle/rollup/getting-started-api#historical-only-search-example
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/rollup-search.html
      operationId: rollup-rollup-search-1
      parameters:
      - $ref: '#/components/parameters/rollup.rollup_search-index'
      - $ref: '#/components/parameters/rollup.rollup_search-rest_total_hits_as_int'
      - $ref: '#/components/parameters/rollup.rollup_search-typed_keys'
      requestBody:
        $ref: '#/components/requestBodies/rollup.rollup_search'
      responses:
        '200':
          $ref: '#/components/responses/rollup.rollup_search-200'
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_rollup/job/{id}/_start:
    post:
      tags:
      - rollup
      summary: Start rollup jobs
      description: 'If you try to start a job that does not exist, an exception occurs.

        If you try to start a job that is already started, nothing happens.


        ## Required authorization


        * Cluster privileges: `manage_rollup`

        '
      operationId: rollup-start-job
      parameters:
      - in: path
        name: id
        description: Identifier for the rollup job.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  started:
                    type: boolean
                required:
                - started
              examples:
                StartRollupJobResponseExample1:
                  description: A successful response from `POST _rollup/job/sensor/_start`.
                  value: "{\n  \"started\": true\n}"
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_rollup/job/{id}/_stop:
    post:
      tags:
      - rollup
      summary: Stop rollup jobs
      description: 'If you try to stop a job that does not exist, an exception occurs.

        If you try to stop a job that is already stopped, nothing happens.


        Since only a stopped job can be deleted, it can be useful to block the API until the indexer has fully stopped.

        This is accomplished with the `wait_for_completion` query parameter, and optionally a timeout. For example:


        ```

        POST _rollup/job/sensor/_stop?wait_for_completion=true&timeout=10s

        ```

        The parameter blocks the API call from returning until either the job has moved to STOPPED or the specified time has elapsed.

        If the specified time elapses without the job moving to STOPPED, a timeout exception occurs.


        ## Required authorization


        * Cluster privileges: `manage_rollup`

        '
      operationId: rollup-stop-job
      parameters:
      - in: path
        name: id
        description: Identifier for the rollup job.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      - in: query
        name: timeout
        description: 'If `wait_for_completion` is `true`, the API blocks for (at maximum) the specified duration while waiting for the job to stop.

          If more than `timeout` time has passed, the API throws a timeout exception.

          NOTE: Even if a timeout occurs, the stop request is still processing and eventually moves the job to STOPPED.

          The timeout simply means the API call itself timed out while waiting for the status change.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: wait_for_completion
        description: 'If set to `true`, causes the API to block until the indexer state completely stops.

          If set to `false`, the API returns immediately and the indexer is stopped asynchronously in the background.'
        deprecated: false
        schema:
          default: false
          type: boolean
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  stopped:
                    type: boolean
                required:
                - stopped
      deprecated: true
      x-state: Experimental; Added in 6.3.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
components:
  schemas:
    _types.query_dsl.SpanContainingQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          big:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
          little:
            description: 'Can be any span query.

              Matching spans from `big` that contain matches from `little` are returned.'
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.SpanQuery'
        required:
        - big
        - little
    _types.query_dsl.TypeQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          value:
            type: string
        required:
        - value
    _types.aggregations.SignificantTermsAggregateBaseSignificantStringTermsBucket:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseSignificantStringTermsBucket'
      - type: object
        properties:
          bg_count:
            type: number
          doc_count:
            type: number
    _types.aggregations.TopHitsAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase'
      - type: object
        properties:
          docvalue_fields:
            description: Fields for which to return doc values.
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          explain:
            description: If `true`, returns detailed information about score computation as part of a hit.
            default: false
            type: boolean
          fields:
            description: 'Array of wildcard (*) patterns. The request returns values for field names

              matching these patterns in the hits.fields property of the response.'
            type: array
            items:
              $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat'
          from:
            description: Starting document offset.
            default: 0.0
            type: number
          highlight:
            description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.Highlight'
          script_fields:
            description: Returns the result of one or more script evaluations for each hit.
            type: object
            additionalProperties:
              $ref: '#/components/schemas/_types.ScriptField'
          size:
            description: The maximum number of top matching hits to return per bucket.
            default: 3.0
            type: number
          sort:
            description: 'Sort order of the top matching hits.

              By default, the hits are sorted by the score of the main query.'
            allOf:
            - $ref: '#/components/schemas/_types.Sort'
          _source:
            description: Selects the fields of the source that are returned.
            allOf:
            - $ref: '#/components/schemas/_global.search._types.SourceConfig'
          stored_fields:
            description: Returns values for the specified stored fields (fields that use the `store` mapping option).
            allOf:
            - $ref: '#/components/schemas/_types.Fields'
          track_scores:
            description: If `true`, calculates and returns document scores, even if the scores are not used for sorting.
            default: false
            type: boolean
          version:
            description: If `true`, returns document version as part of a hit.
            default: false
            type: boolean
          seq_no_primary_term:
            description: If `true`, returns sequence number and primary term of the last modification of each hit.
            type: boolean
    _types.query_dsl.CombinedFieldsZeroTerms:
      type: string
      enum:
      - none
      - all
    _types.aggregations.BucketSelectorAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase'
      - type: object
        properties:
          script:
            description: The script to run for this aggregation.
            allOf:
            - $ref: '#/components/schemas/_types.Script'
    _types.aggregations.TermsPartition:
      type: object
      properties:
        num_partitions:
          description: The number of partitions.
          type: number
        partition:
          description: The partition number for this request.
          type: number
      required:
      - num_partitions
      - partition
    _types.query_dsl.GeoBoundingBoxQuery:
      allOf:
      - $ref: '#/components/schemas/_types.query_dsl.QueryBase'
      - type: object
        properties:
          type:
            deprecated: true
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoExecution'
          validation_method:
            description: 'Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude.

              Set to `COERCE` to also try to infer correct latitude or longitude.'
            default: '''strict'''
            allOf:
            - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod'
          ignore_unmapped:
            description: 'Set to `true` to ignore an unmapped field and not match any documents for this query.

              Set to `false` to throw an exception if the field is not mapped.'
            default: false
            type: boolean
    _types.SortResults:
      type: array
      items:
        $ref: '#/components/schemas/_types.FieldValue'
    _types.aggregations.IpRangeAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseIpRangeBucket'
      - type: object
    _types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator:
      type: object
      properties:
        doc_count:
          description: 'The total number of documents that initially created the expectations. It’s required to be greater

            than or equal to the sum of all values in the buckets_path as this is the originating superset of data

            to which the term values are correlated.'
          type: number
        expectations:
          description: 'An array of numbers with which to correlate the configured `bucket_path` values.

            The length of this value must always equal the number of buckets returned by the `bucket_path`.'
          type: array
          items:
            type: number
        fractions:
          description: 'An array of fractions to use when averaging and calculating variance. This should be used if

            the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided,

            must equal expectations.'
          type: array
          items:
            type: number
      required:
      - doc_count
      - expectations
    _types.aggregations.LongRareTermsAggregate:
      description: Result of the `rare_terms` aggregation when the field is some kind of whole number like a integer, long, or a date.
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseLongRareTermsBucket'
      - type: object
    _types.aggregations.TimeSeriesAggregate:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.MultiBucketAggregateBaseTimeSeriesBucket'
      - type: object
    _types.EpochTimeUnitMillis:
      allOf:
      - $ref: '#/components/schemas/_types.UnitMillis'
    _types.aggregations.ChildrenAggregation:
      allOf:
      - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase'
      - type: object
        properties:
          type:
            description: The child type that should be selected.
            allOf:
            - $ref: '#/components/schemas/_types.RelationName'

# --- truncated at 32 KB (437 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-rollup-api-openapi.yml