---
type: api
title: Get overall bucket results
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v8/operation/operation-ml-get-overall-buckets
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v8/operation/operation-ml-get-overall-buckets
products:
  - Elasticsearch
---

# Get overall bucket results


Availability: 6.1+

## Paths

- `POST` (also `GET`) `/_ml/anomaly_detectors/{job_id}/results/overall_buckets`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v8/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v8/authentication#bearerauth)

#### Path Parameters

- `job_id` (string Id)
  Identifier for the anomaly detection job. It can be a job identifier, a
group name, a comma-separated list of jobs or groups, or a wildcard
expression.

You can summarize the bucket results for all anomaly detection jobs by
using `_all` or by specifying `*` as the `<job_id>`.

## Description

Retrievs overall bucket results that summarize the bucket results of
multiple anomaly detection jobs.

The `overall_score` is calculated by combining the scores of all the
buckets within the overall bucket span. First, the maximum
`anomaly_score` per anomaly detection job in the overall bucket is
calculated. Then the `top_n` of those scores are averaged to result in
the `overall_score`. This means that you can fine-tune the
`overall_score` so that it is more or less sensitive to the number of
jobs that detect an anomaly at the same time. For example, if you set
`top_n` to `1`, the `overall_score` is the maximum bucket score in the
overall bucket. Alternatively, if you set `top_n` to the number of jobs,
the `overall_score` is high only when all jobs detect anomalies in that
overall bucket. If you set the `bucket_span` parameter (to a value
greater than its default), the `overall_score` is the maximum
`overall_score` of the overall buckets that have a span equal to the
jobs' largest bucket span.

## Required authorization

* Cluster privileges: `monitor_ml`

## Query String Parameters

- `allow_no_match` (boolean · default: true)
  Specifies what to do when the request:

1. Contains wildcard expressions and there are no jobs that match.
2. Contains the `_all` string or no identifiers and there are no matches.
3. Contains wildcard expressions and there are only partial matches.

If `true`, the request returns an empty `jobs` array when there are no
matches and the subset of results when there are partial matches. If this
parameter is `false`, the request returns a `404` status code when there
are no matches or only partial matches.
- `bucket_span` (string Duration)
  The span of the overall buckets. Must be greater or equal to the largest
bucket span of the specified anomaly detection jobs, which is the default
value.

By default, an overall bucket has a span equal to the largest bucket span
of the specified anomaly detection jobs. To override that behavior, use
the optional `bucket_span` parameter.
- `end` (union DateTime)
  Returns overall buckets with timestamps earlier than this time.
  One of: `string` or `EpochTimeUnitMillis`
- `exclude_interim` (boolean · default: false)
  If `true`, the output excludes interim results.
- `overall_score` (number | string)
  Returns overall buckets with overall scores greater than or equal to this
value.
- `start` (union DateTime)
  Returns overall buckets with timestamps after this time.
  One of: `string` or `EpochTimeUnitMillis`
- `top_n` (number · default: 1)
  The number of top anomaly detection job bucket scores to be used in the
`overall_score` calculation.

## Request Body

`application/json`

- `allow_no_match` (boolean · default: true) — optional
  Refer to the description for the `allow_no_match` query parameter.
- `bucket_span` (string Duration) — optional
  Refer to the description for the `bucket_span` query parameter.
- `end` (DateTime) — optional
  Refer to the description for the `end` query parameter.
- `exclude_interim` (boolean · default: false) — optional
  Refer to the description for the `exclude_interim` query parameter.
- `overall_score` (number | string) — optional
  Refer to the description for the `overall_score` query parameter.
- `start` (DateTime) — optional
  Refer to the description for the `start` query parameter.
- `top_n` (number · default: 1) — optional
  Refer to the description for the `top_n` query parameter.

## Response

`application/json`

- `count` (number)
- `overall_buckets` ([] OverallBucket)
  Array of overall bucket objects
  - `bucket_span` (DurationValueUnitSeconds)
    The length of the bucket in seconds. Matches the job with the longest bucket_span value.
  - `is_interim` (boolean)
    If true, this is an interim result. In other words, the results are calculated based on partial input data.
  - `jobs` ([] OverallBucketJob)
    An array of objects that contain the max_anomaly_score per job_id.
    - `job_id` (string Id)
    - `max_anomaly_score` (number)
  - `overall_score` (number)
    The top_n average of the maximum bucket anomaly_score per job.
  - `result_type` (string)
    Internal. This is always set to overall_bucket.
  - `timestamp` (EpochTimeUnitMillis)
    The start time of the bucket for which these results were calculated.
  - `timestamp_string` (DateTime)
    The start time of the bucket for which these results were calculated.
## Code Examples

#### Console

```console
POST _ml/anomaly_detectors/job-*/results/overall_buckets
{
  "overall_score": 80,
  "start": "1403532000000"
}
```

#### JavaScript

```javascript
const response = await client.ml.getOverallBuckets({
  job_id: "job-*",
  overall_score: 80,
  start: 1403532000000,
});
```

#### Python

```python
resp = client.ml.get_overall_buckets(
    job_id="job-*",
    overall_score=80,
    start="1403532000000",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-*/results/overall_buckets" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "overall_score": 80,
    "start": "1403532000000"
  }'
```

#### Java

```java
client.ml().getOverallBuckets(g -> g
    .jobId("job-*")
    .overallScore("80")
    .start(DateTime.of("1403532000000"))
);
```

#### C#

```c#
var response = await client.MachineLearning
    .GetOverallBucketsAsync(jobId: "job-*", d1 => d1
        .OverallScore(80d)
        .Start(DateTimeOffset.Parse("2014-06-23T14:00:00.0000000+00:00", CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind))
    );
```

#### PHP

```php
$resp = $client->ml()->getOverallBuckets([
    "job_id" => "job-*",
    "body" => [
        "overall_score" => 80,
        "start" => "1403532000000",
    ],
]);
```

#### Ruby

```ruby
response = client.ml.get_overall_buckets(
  job_id: "job-*",
  body: {
    "overall_score": 80,
    "start": "1403532000000"
  }
)
```