---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    indices.create:
      index: "airline-data"
      body:
        mappings:
          properties:
            time:
              type: "date"
            airline:
              type: "keyword"
            responsetime:
              type: "float"
            event_rate:
              type: "integer"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "airline-data"
      id: "1"
      body: "{\n  \"time\": \"2017-02-18T00:00:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 1.0,\n  \"event_rate\": 5\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "airline-data"
      id: "2"
      body: "{\n  \"time\": \"2017-02-18T00:30:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 1.0,\n  \"event_rate\": 6\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "airline-data"
      id: "3"
      body: "{\n  \"time\": \"2017-02-18T01:00:00Z\",\n  \"airline\": \"bar\",\n \
        \ \"responsetime\": 42.0,\n  \"event_rate\": 8\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "airline-data"
      id: "4"
      body: "{\n  \"time\": \"2017-02-18T01:01:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 42.0,\n  \"event_rate\": 7\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.refresh:
      index: "airline-data"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview scroll datafeed:
- do:
    ml.put_job:
      job_id: "preview-datafeed-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"1h\",\n      \"\
        detectors\" :[{\"function\":\"sum\",\"field_name\":\"responsetime\",\"by_field_name\"\
        :\"airline\"}]\n  },\n  \"data_description\" : {\n      \"time_field\":\"\
        time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "preview-datafeed-feed"
      body: "{\n  \"job_id\":\"preview-datafeed-job\",\n  \"indexes\":\"airline-data\"\
        \n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "preview-datafeed-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
- do:
    ml.preview_datafeed:
      datafeed_id: "preview-datafeed-feed"
      body: "{}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
- do:
    ml.preview_datafeed:
      body: "{\n  \"datafeed_config\": {\n    \"job_id\":\"preview-datafeed-job\"\
        ,\n    \"indexes\":\"airline-data\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
- do:
    ml.preview_datafeed:
      body: "{\n  \"datafeed_config\": {\n    \"job_id\":\"preview-datafeed-job\"\
        ,\n    \"indexes\":\"airline-data\"\n  },\n  \"job_config\": {\n    \"analysis_config\"\
        : {\n      \"bucket_span\": \"1h\",\n      \"detectors\": [{\"function\":\"\
        sum\",\"field_name\":\"responsetime\",\"by_field_name\":\"airline\"}]\n  \
        \  },\n    \"data_description\": {\n      \"time_field\":\"time\"\n    }\n\
        \  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
- do:
    ml.preview_datafeed:
      body: "{\n  \"job_config\": {\n    \"analysis_config\": {\n      \"bucket_span\"\
        : \"1h\",\n      \"detectors\": [{\"function\":\"sum\",\"field_name\":\"responsetime\"\
        ,\"by_field_name\":\"airline\"}]\n    },\n    \"data_description\": {\n  \
        \    \"time_field\":\"time\"\n    },\n    \"datafeed_config\": {\n      \"\
        indexes\":\"airline-data\"\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
---
Test preview aggregation datafeed with doc_count:
- do:
    ml.put_job:
      job_id: "aggregation-doc-count-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"1h\",\n      \"\
        summary_count_field_name\": \"doc_count\",\n      \"detectors\" :[{\"function\"\
        :\"sum\",\"field_name\":\"responsetime\",\"by_field_name\":\"airline\"}]\n\
        \  },\n  \"data_description\" : {\n      \"time_field\":\"time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "aggregation-doc-count-feed"
      body: "{\n  \"job_id\":\"aggregation-doc-count-job\",\n  \"indexes\":\"airline-data\"\
        ,\n  \"aggregations\": {\n    \"buckets\": {\n      \"histogram\": {\n   \
        \     \"field\": \"time\",\n        \"interval\": 3600000\n      },\n    \
        \  \"aggregations\": {\n        \"time\": {\n          \"max\": {\n      \
        \      \"field\": \"time\"\n          }\n        },\n        \"airline\":\
        \ {\n          \"terms\": {\n            \"field\": \"airline\",\n       \
        \     \"size\": 100\n          },\n          \"aggregations\": {\n       \
        \     \"responsetime\": {\n              \"sum\": {\n                 \"field\"\
        : \"responsetime\"\n              }\n            }\n          }\n        }\n\
        \      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "aggregation-doc-count-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 3
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 2.0
- match:
    "0.doc_count": 2
- match:
    "1.time": 1487379660000
- match:
    "1.airline": "bar"
- match:
    "1.responsetime": 42.0
- match:
    "1.doc_count": 1
- match:
    "1.time": 1487379660000
- match:
    "2.airline": "foo"
- match:
    "2.responsetime": 42.0
- match:
    "2.doc_count": 1
- do:
    ml.preview_datafeed:
      body: "{\n  \"datafeed_config\": {\n    \"indexes\":\"airline-data\",\n    \"\
        aggregations\": {\n      \"buckets\": {\n        \"histogram\": {\n      \
        \    \"field\": \"time\",\n          \"interval\": 3600000\n        },\n \
        \       \"aggregations\": {\n          \"time\": {\n            \"max\": {\n\
        \              \"field\": \"time\"\n            }\n          },\n        \
        \  \"airline\": {\n            \"terms\": {\n              \"field\": \"airline\"\
        ,\n              \"size\": 100\n            },\n            \"aggregations\"\
        : {\n              \"responsetime\": {\n                \"sum\": {\n     \
        \              \"field\": \"responsetime\"\n                }\n          \
        \    }\n            }\n          }\n        }\n      }\n    }\n  },\n  \"\
        job_config\": {\n    \"analysis_config\" : {\n        \"bucket_span\": \"\
        1h\",\n        \"summary_count_field_name\": \"doc_count\",\n        \"detectors\"\
        \ :[{\"function\":\"sum\",\"field_name\":\"responsetime\",\"by_field_name\"\
        :\"airline\"}]\n    },\n    \"data_description\" : {\n        \"time_field\"\
        :\"time\"\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 3
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 2.0
- match:
    "0.doc_count": 2
- match:
    "1.time": 1487379660000
- match:
    "1.airline": "bar"
- match:
    "1.responsetime": 42.0
- match:
    "1.doc_count": 1
- match:
    "1.time": 1487379660000
- match:
    "2.airline": "foo"
- match:
    "2.responsetime": 42.0
- match:
    "2.doc_count": 1
- do:
    ml.preview_datafeed:
      body: "{\n  \"job_config\": {\n    \"analysis_config\" : {\n        \"bucket_span\"\
        : \"1h\",\n        \"summary_count_field_name\": \"doc_count\",\n        \"\
        detectors\" :[{\"function\":\"sum\",\"field_name\":\"responsetime\",\"by_field_name\"\
        :\"airline\"}]\n    },\n    \"data_description\" : {\n        \"time_field\"\
        :\"time\"\n    },\n    \"datafeed_config\": {\n      \"indexes\":\"airline-data\"\
        ,\n      \"aggregations\": {\n        \"buckets\": {\n          \"histogram\"\
        : {\n            \"field\": \"time\",\n            \"interval\": 3600000\n\
        \          },\n          \"aggregations\": {\n            \"time\": {\n  \
        \            \"max\": {\n                \"field\": \"time\"\n           \
        \   }\n            },\n            \"airline\": {\n              \"terms\"\
        : {\n                \"field\": \"airline\",\n                \"size\": 100\n\
        \              },\n              \"aggregations\": {\n                \"responsetime\"\
        : {\n                  \"sum\": {\n                     \"field\": \"responsetime\"\
        \n                  }\n                }\n              }\n            }\n\
        \          }\n        }\n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 3
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 2.0
- match:
    "0.doc_count": 2
- match:
    "1.time": 1487379660000
- match:
    "1.airline": "bar"
- match:
    "1.responsetime": 42.0
- match:
    "1.doc_count": 1
- match:
    "1.time": 1487379660000
- match:
    "2.airline": "foo"
- match:
    "2.responsetime": 42.0
- match:
    "2.doc_count": 1
---
Test preview single metric aggregation datafeed with different summary count field:
- do:
    ml.put_job:
      job_id: "aggregation-custom-single-metric-summary-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"3600s\",\n   \
        \   \"summary_count_field_name\": \"dc_airline\",\n      \"detectors\" :[{\"\
        function\":\"count\"}]\n  },\n  \"data_description\" : {\n      \"time_field\"\
        :\"time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "aggregation-custom-single-metric-summary-feed"
      body: "{\n  \"job_id\":\"aggregation-custom-single-metric-summary-job\",\n \
        \ \"indexes\":\"airline-data\",\n  \"aggregations\": {\n    \"buckets\": {\n\
        \      \"histogram\": {\n        \"field\": \"time\",\n        \"interval\"\
        : 3600000\n      },\n      \"aggregations\": {\n        \"time\": {\n    \
        \      \"max\": {\n            \"field\": \"time\"\n          }\n        },\n\
        \        \"dc_airline\": {\n          \"cardinality\": {\n            \"field\"\
        : \"airline\"\n          }\n        }\n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "aggregation-custom-single-metric-summary-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 2
- match:
    "0.time": 1487377800000
- match:
    "0.dc_airline": 1
- is_false: "0.doc_count"
- match:
    "1.time": 1487379660000
- match:
    "1.dc_airline": 2
- is_false: "1.doc_count"
---
Test preview multi metric aggregation datafeed with different summary count field:
- do:
    ml.put_job:
      job_id: "aggregation-custom-multi-metric-summary-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"3600s\",\n   \
        \   \"summary_count_field_name\": \"event_rate\",\n      \"detectors\" :[{\"\
        function\":\"mean\",\"field_name\":\"responsetime\",\"by_field_name\":\"airline\"\
        }]\n  },\n  \"data_description\" : {\n      \"time_field\":\"time\"\n  }\n\
        }\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "aggregation-custom-multi-metric-summary-feed"
      body: "{\n  \"job_id\":\"aggregation-custom-multi-metric-summary-job\",\n  \"\
        indexes\":\"airline-data\",\n  \"aggregations\": {\n    \"buckets\": {\n \
        \     \"histogram\": {\n        \"field\": \"time\",\n        \"interval\"\
        : 3600000\n      },\n      \"aggregations\": {\n        \"time\": {\n    \
        \      \"max\": {\n            \"field\": \"time\"\n          }\n        },\n\
        \        \"airline\": {\n          \"terms\": {\n              \"field\":\
        \ \"airline\"\n          },\n          \"aggs\": {\n            \"responsetime\"\
        : {\n              \"sum\": {\n                \"field\": \"responsetime\"\
        \n              }\n            },\n            \"event_rate\": {\n       \
        \       \"sum\": {\n                \"field\": \"event_rate\"\n          \
        \    }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "aggregation-custom-multi-metric-summary-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 3
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 2.0
- match:
    "0.event_rate": 11
- is_false: "0.doc_count"
- match:
    "1.time": 1487379660000
- match:
    "1.airline": "bar"
- match:
    "1.responsetime": 42.0
- match:
    "1.event_rate": 8
- is_false: "1.doc_count"
- match:
    "1.time": 1487379660000
- match:
    "2.airline": "foo"
- match:
    "2.responsetime": 42.0
- match:
    "2.event_rate": 7
- is_false: "2.doc_count"
---
Test preview missing datafeed:
- do:
    catch: "missing"
    ml.preview_datafeed:
      datafeed_id: "missing-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview with datafeed_id and job config:
- do:
    catch: "bad_request"
    ml.preview_datafeed:
      datafeed_id: "some_datafeed_id"
      body: "{\n   \"job_config\": {\n     \"analysis_config\" : {\n       \"bucket_span\"\
        : \"1h\",\n       \"detectors\" :[{\"function\":\"sum\",\"field_name\":\"\
        responsetime\",\"by_field_name\":\"airline\"}]\n     },\n     \"data_description\"\
        \ : {\n       \"time_field\":\"time\"\n     }\n   }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview with datafeed id and config:
- do:
    catch: "bad_request"
    ml.preview_datafeed:
      body: "{\n   \"job_config\": {\n     \"analysis_config\" : {\n       \"bucket_span\"\
        : \"1h\",\n       \"detectors\" :[{\"function\":\"sum\",\"field_name\":\"\
        responsetime\",\"by_field_name\":\"airline\"}]\n     },\n     \"data_description\"\
        \ : {\n       \"time_field\":\"time\"\n     }\n   }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview with datafeed config and job config with datafeed config:
- do:
    catch: "bad_request"
    ml.preview_datafeed:
      body: "{\n  \"datafeed_config\": {\n    \"indexes\":\"airline-data\"\n  },\n\
        \  \"job_config\": {\n    \"analysis_config\" : {\n      \"bucket_span\":\
        \ \"1h\",\n      \"detectors\" :[{\"function\":\"sum\",\"field_name\":\"responsetime\"\
        ,\"by_field_name\":\"airline\"}]\n    },\n    \"data_description\" : {\n \
        \     \"time_field\":\"time\"\n    },\n    \"datafeed_config\": {\n      \"\
        indexes\":\"airline-data\"\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview datafeed with unavailable index:
- do:
    ml.put_job:
      job_id: "unavailable-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"1h\",\n      \"\
        detectors\" :[{\"function\":\"sum\",\"field_name\":\"responsetime\",\"by_field_name\"\
        :\"airline\"}]\n  },\n  \"data_description\" : {\n      \"time_field\":\"\
        time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "unavailable-feed"
      body: "{\n  \"job_id\":\"unavailable-job\",\n  \"indexes\":\"unavailable-data\"\
        \n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    catch: "missing"
    ml.preview_datafeed:
      datafeed_id: "unavailable-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test preview datafeed with query that matches nothing:
- do:
    ml.put_job:
      job_id: "empty-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"1h\",\n      \"\
        detectors\" :[{\"function\":\"sum\",\"field_name\":\"responsetime\",\"by_field_name\"\
        :\"airline\"}]\n  },\n  \"data_description\" : {\n      \"time_field\":\"\
        time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "empty-feed"
      body: "{\n  \"job_id\":\"empty-job\",\n  \"indexes\":\"airline-data\",\n  \"\
        query\": {\n    \"term\": {\"airline\":\"missing\"}\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "empty-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 0
---
Test preview aggregation with runtime fields:
- do:
    ml.put_job:
      job_id: "runtime-field-aggregation-job"
      body: "{\n  \"analysis_config\" : {\n      \"bucket_span\": \"3600s\",\n   \
        \   \"summary_count_field_name\": \"doc_count\",\n      \"detectors\" :[{\"\
        function\":\"mean\",\"field_name\":\"responsetime_x_2\",\"by_field_name\"\
        :\"airline\"}]\n  },\n  \"data_description\" : {\n      \"time_field\":\"\
        time\"\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.put_datafeed:
      datafeed_id: "aggregation-doc-count-feed"
      body: "{\n  \"job_id\":\"runtime-field-aggregation-job\",\n  \"indexes\":\"\
        airline-data\",\n  \"runtime_mappings\" : {\n    \"responsetime_x_2\": {\n\
        \      \"type\": \"double\",\n      \"script\": \"emit(doc['responsetime'].value\
        \ * 2.0)\"\n    }\n  },\n  \"aggregations\": {\n    \"buckets\": {\n     \
        \ \"histogram\": {\n        \"field\": \"time\",\n        \"interval\": 3600000\n\
        \      },\n      \"aggregations\": {\n        \"time\": {\n          \"max\"\
        : {\n            \"field\": \"time\"\n          }\n        },\n        \"\
        airline\": {\n          \"terms\": {\n            \"field\": \"airline\",\n\
        \            \"size\": 100\n          },\n          \"aggregations\": {\n\
        \            \"responsetime_x_2\": {\n              \"sum\": {\n         \
        \        \"field\": \"responsetime_x_2\"\n              }\n            }\n\
        \          }\n        }\n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      datafeed_id: "aggregation-doc-count-feed"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 3
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime_x_2": 4.0
- match:
    "0.doc_count": 2
- match:
    "1.time": 1487379660000
- match:
    "1.airline": "bar"
- match:
    "1.responsetime_x_2": 84.0
- match:
    "1.doc_count": 1
- match:
    "1.time": 1487379660000
- match:
    "2.airline": "foo"
- match:
    "2.responsetime_x_2": 84.0
- match:
    "2.doc_count": 1
---
Test preview datafeed where time field is data_nanos:
- do:
    indices.create:
      index: "index-airline-data-date-nanos"
      body:
        mappings:
          properties:
            time:
              type: "date_nanos"
            airline:
              type: "keyword"
            responsetime:
              type: "float"
            event_rate:
              type: "integer"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "index-airline-data-date-nanos"
      id: "1"
      body: "{\n  \"time\": \"2017-02-18T00:00:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 1.0,\n  \"event_rate\": 5\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "index-airline-data-date-nanos"
      id: "2"
      body: "{\n  \"time\": \"2017-02-18T00:30:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 1.0,\n  \"event_rate\": 6\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "index-airline-data-date-nanos"
      id: "3"
      body: "{\n  \"time\": \"2017-02-18T01:00:00Z\",\n  \"airline\": \"bar\",\n \
        \ \"responsetime\": 42.0,\n  \"event_rate\": 8\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    index:
      index: "index-airline-data-date-nanos"
      id: "4"
      body: "{\n  \"time\": \"2017-02-18T01:01:00Z\",\n  \"airline\": \"foo\",\n \
        \ \"responsetime\": 42.0,\n  \"event_rate\": 7\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.refresh:
      index: "index-airline-data-date-nanos"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    ml.preview_datafeed:
      body: "{\n  \"datafeed_config\": {\n    \"indexes\":\"index-airline-data-date-nanos\"\
        \n  },\n  \"job_config\": {\n    \"analysis_config\": {\n      \"bucket_span\"\
        : \"1h\",\n      \"detectors\": [{\"function\":\"sum\",\"field_name\":\"responsetime\"\
        ,\"by_field_name\":\"airline\"}]\n    },\n    \"data_description\": {\n  \
        \    \"time_field\":\"time\"\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 4
- match:
    "0.time": 1487376000000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
- match:
    "1.time": 1487377800000
- match:
    "1.airline": "foo"
- match:
    "1.responsetime": 1.0
- match:
    "2.time": 1487379600000
- match:
    "2.airline": "bar"
- match:
    "2.responsetime": 42.0
- match:
    "3.time": 1487379660000
- match:
    "3.airline": "foo"
- match:
    "3.responsetime": 42.0
---
Test preview datafeed with start and end:
- do:
    ml.preview_datafeed:
      start: "2017-02-18T00:30:00Z"
      end: "2017-02-18T01:00:00Z"
      body: "{\n  \"datafeed_config\": {\n    \"job_id\":\"preview-datafeed-job\"\
        ,\n    \"indexes\":\"airline-data\"\n  },\n  \"job_config\": {\n    \"analysis_config\"\
        : {\n      \"bucket_span\": \"1h\",\n      \"detectors\": [{\"function\":\"\
        sum\",\"field_name\":\"responsetime\",\"by_field_name\":\"airline\"}]\n  \
        \  },\n    \"data_description\": {\n      \"time_field\":\"time\"\n    }\n\
        \  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    $body: 1
- match:
    "0.time": 1487377800000
- match:
    "0.airline": "foo"
- match:
    "0.responsetime": 1.0
