Get overall bucket results

POST also GET /_ml/anomaly_detectors/{job_id}/results/overall_buckets

Retrievs overall bucket results that summarize the bucket results of multiple anomaly detection jobs.

The overall_score is calculated by combining the scores of all the buckets within the overall bucket span. First, the maximum anomaly_score per anomaly detection job in the overall bucket is calculated. Then the top_n of those scores are averaged to result in the overall_score. This means that you can fine-tune the overall_score so that it is more or less sensitive to the number of jobs that detect an anomaly at the same time. For example, if you set top_n to 1, the overall_score is the maximum bucket score in the overall bucket. Alternatively, if you set top_n to the number of jobs, the overall_score is high only when all jobs detect anomalies in that overall bucket. If you set the bucket_span parameter (to a value greater than its default), the overall_score is the maximum overall_score of the overall buckets that have a span equal to the jobs' largest bucket span.

Required authorization

Cluster privileges: monitor_ml

Path Parameters

job_id string Id required

Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression.

You can summarize the bucket results for all anomaly detection jobs by using _all or by specifying * as the <job_id>.

An example body for a GET _ml/anomaly_detectors/job-*/results/overall_buckets request.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST _ml/anomaly_detectors/job-*/results/overall_buckets
{
  "overall_score": 80,
  "start": "1403532000000"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.ml.getOverallBuckets({
  job_id: "job-*",
  overall_score: 80,
  start: 1403532000000,
});

Python Elasticsearch Python Client

resp = client.ml.get_overall_buckets(
    job_id="job-*",
    overall_score=80,
    start="1403532000000",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-*/results/overall_buckets" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "overall_score": 80,
    "start": "1403532000000"
  }'

Java Elasticsearch Java Client

client.ml().getOverallBuckets(g -> g
    .jobId("job-*")
    .overallScore("80")
    .start(DateTime.of("1403532000000"))
);

C# Elasticsearch .NET Client

var response = await client.MachineLearning
    .GetOverallBucketsAsync(jobId: "job-*", d1 => d1
        .OverallScore(80d)
        .Start(DateTimeOffset.Parse("2014-06-23T14:00:00.0000000+00:00", CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind))
    );

PHP Elasticsearch PHP Client

$resp = $client->ml()->getOverallBuckets([
    "job_id" => "job-*",
    "body" => [
        "overall_score" => 80,
        "start" => "1403532000000",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.ml.get_overall_buckets(
  job_id: "job-*",
  body: {
    "overall_score": 80,
    "start": "1403532000000"
  }
)

Response

No example

Required authorization

Path Parameters

Query Parameters { allow_no_match , bucket_span , end , exclude_interim , overall_score , start , top_n , }

Request { allow_no_match , bucket_span , end , exclude_interim , overall_score , start , top_n , }

Response

Query Parameters

Request