Get anomaly detection job results for influencers
- POST also GET /_ml/anomaly_detectors/{job_id}/results/influencers
Influencers are the entities that have contributed to, or are to blame for,
the anomalies. Influencer results are available only if an
influencer_field_name is specified in the job configuration.
- Cluster privileges:
monitor_ml
Path Parameters
-
job_idstring Idrequired -
Identifier for the anomaly detection job.
Query Parameters
-
descboolean · default: false If true, the results are sorted in descending order.
-
endDateTime · default: -1 Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.
-
exclude_interimboolean · default: false If true, the output excludes interim results. By default, interim results are included.
-
influencer_scorenumber · default: 0 Returns influencers with anomaly scores greater than or equal to this value.
-
fromnumber · default: 0 Skips the specified number of influencers.
-
sizenumber · default: 100 Specifies the maximum number of influencers to obtain.
-
sortstring Field Specifies the sort field for the requested influencers. By default, the influencers are sorted by the
influencer_scorevalue.-
startDateTime · default: -1 Returns influencers with timestamps after this time. The default value means it is unset and results are not limited to specific timestamps.
Response
-
countnumberrequired -
influencersInfluencerrequired -
Array of influencer objects
-
bucket_spanDurationValueUnitSecondsrequired -
The length of the bucket in seconds. This value matches the bucket span that is specified in the job.
-
influencer_scorenumberrequired -
A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated across detectors. Unlike
initial_influencer_score, this value is updated by a re-normalization process as new data is analyzed. -
influencer_field_namestring Fieldrequired -
The field name of the influencer.
-
influencer_field_valuestringrequired -
The entity that influenced, contributed to, or was to blame for the anomaly.
-
initial_influencer_scorenumberrequired -
A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors. This is the initial value that was calculated at the time the bucket was processed.
-
is_interimbooleanrequired -
If true, this is an interim result. In other words, the results are calculated based on partial input data.
-
job_idstring Idrequired -
Identifier for the anomaly detection job.
-
probabilitynumberrequired -
The probability that the influencer has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the
influencer_scoreis provided as a human-readable and friendly interpretation of this value. -
result_typestringrequired -
Internal. This value is always set to
influencer. -
timestampEpochTimeUnitMillisrequired -
The start time of the bucket for which these results were calculated.
-
foostring -
Additional influencer properties are added, depending on the fields being analyzed. For example, if it’s analyzing
user_nameas an influencer, a fielduser_nameis added to the result document. This information enables you to filter the anomaly results more easily.