Downsample time series data

Stack Serverless

To downsample a time series via a data stream lifecycle, add a downsampling section to the data stream lifecycle (for existing data streams) or the index template (for new data streams).

• Set fixed_interval to your preferred level of granularity. The original time series data will be aggregated at this interval.
• Set after to the minimum time to wait after an index rollover, before running downsampling.

				PUT _data_stream/my-data-stream/_lifecycle
					{
  "data_retention": "7d",
  "downsampling": [
     {
       "after": "1m",
       "fixed_interval": "10m"
      },
      {
        "after": "1d",
        "fixed_interval": "1h"
      }
   ]
}
		

The downsampling action runs after the index time series end time has passed.

Stack Serverless Unavailable

To downsample time series data as part of index lifecycle management (ILM), include downsample actions in your ILM policy. You can configure multiple downsampling actions across different phases to progressively reduce data granularity over time.

This example shows a policy with rollover and two downsampling actions: one in the hot phase for initial aggregation at 5-minute intervals, and another in the warm phase for further aggregation at 1-hour intervals:

				PUT _ilm/policy/datastream_policy
					{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover" : {
            "max_age": "5m"
          },
          "downsample": {
  	        "fixed_interval": "5m"
  	      }
        }
      },
      "warm": {
        "actions": {
          "downsample": {
            "fixed_interval": "1h"
          }
        }
      }
    }
  }
}
		

Set fixed_interval to your preferred level of granularity. The original time series data will be aggregated at this interval. The downsample action runs after the index is rolled over and the index time series end time has passed.