---
type: api
title: Get anomaly detection job results for categories
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-ml-get-categories
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/operation/operation-ml-get-categories
products:
  - Elasticsearch
---

# Get anomaly detection job results for categories


Availability: 5.4+

## Paths

- `POST` (also `GET`) `/_ml/anomaly_detectors/{job_id}/results/categories/{category_id}`
- `POST` (also `GET`) `/_ml/anomaly_detectors/{job_id}/results/categories`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/authentication#bearerauth)

#### Path Parameters

- `job_id` (string Id)
  Identifier for the anomaly detection job.
- `category_id` (number) — optional, leave it out to use `/_ml/anomaly_detectors/{job_id}/results/categories`
  Identifier for the category, which is unique in the job. If you specify
neither the category ID nor the partition_field_value, the API returns
information about all categories. If you specify only the
partition_field_value, it returns information about all categories for
the specified partition.

## Description

## Required authorization

* Cluster privileges: `monitor_ml`

## Query String Parameters

- `from` (number · default: 0)
  Skips the specified number of categories.
- `partition_field_value` (string)
  Only return categories for the specified partition.
- `size` (number · default: 100)
  Specifies the maximum number of categories to obtain.

## Request Body

`application/json`

- `page` ({} Page) — optional
  Configures pagination.
This parameter has the `from` and `size` properties.
  - `from` (number · default: 0) — optional
    Skips the specified number of items.
  - `size` (number · default: 10000) — optional
    Specifies the maximum number of items to obtain.

## Response

`application/json`

- `categories` ([] Category)
  - `category_id` (number ulong)
    A unique identifier for the category. category_id is unique at the job level, even when per-partition categorization is enabled.
  - `examples` ([] string)
    A list of examples of actual values that matched the category.
  - `grok_pattern` (string)
    [experimental] A Grok pattern that could be used in Logstash or an ingest pipeline to extract fields from messages that match the category. This field is experimental and may be changed or removed in a future release. The Grok patterns that are found are not optimal, but are often a good starting point for manual tweaking.
  - `job_id` (string Id)
    Identifier for the anomaly detection job.
  - `max_matching_length` (number ulong)
    The maximum length of the fields that matched the category. The value is increased by 10% to enable matching for similar fields that have not been analyzed.
  - `partition_field_name` (string)
    If per-partition categorization is enabled, this property identifies the field used to segment the categorization. It is not present when per-partition categorization is disabled.
  - `partition_field_value` (string)
    If per-partition categorization is enabled, this property identifies the value of the partition_field_name for the category. It is not present when per-partition categorization is disabled.
  - `regex` (string)
    A regular expression that is used to search for values that match the category.
  - `terms` (string)
    A space separated list of the common tokens that are matched in values of the category.
  - `num_matches` (number)
    The number of messages that have been matched by this category. This is only guaranteed to have the latest accurate count after a job _flush or _close
  - `preferred_to_categories` ([] string Id)
    A list of category_id entries that this current category encompasses. Any new message that is processed by the categorizer will match against this category and not any of the categories in this list. This is only guaranteed to have the latest accurate list of categories after a job _flush or _close
  - `p` (string)
  - `result_type` (string)
  - `mlcategory` (string)
- `count` (number)
## Code Examples

#### Console

```console
POST _ml/anomaly_detectors/esxi_log/results/categories
{
  "page":{
    "size": 1
  }
}
```

#### JavaScript

```javascript
const response = await client.ml.getCategories({
  job_id: "esxi_log",
  page: {
    size: 1,
  },
});
```

#### Python

```python
resp = client.ml.get_categories(
    job_id="esxi_log",
    page={
        "size": 1
    },
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/esxi_log/results/categories" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "page": {
      "size": 1
    }
  }'
```

#### Java

```java
client.ml().getCategories(g -> g
    .jobId("esxi_log")
    .page(p -> p
        .size(1)
    )
);
```

#### C#

```c#
var response = await client.MachineLearning
    .GetCategoriesAsync(new GetCategoriesRequest()
    {
        JobId = "esxi_log",
        Page = new()
        {
            Size = 1
        }
    });
```

#### PHP

```php
$resp = $client->ml()->getCategories([
    "job_id" => "esxi_log",
    "body" => [
        "page" => [
            "size" => 1,
        ],
    ],
]);
```

#### Ruby

```ruby
response = client.ml.get_categories(
  job_id: "esxi_log",
  body: {
    "page": {
      "size": 1
    }
  }
)
```