---
type: api
title: Get overall bucket results
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch-serverless/operation/operation-ml-get-overall-buckets
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch-serverless/operation/operation-ml-get-overall-buckets
products:
  - Elasticsearch Serverless
---

# Get overall bucket results


## Paths

- `POST` (also `GET`) `/_ml/anomaly_detectors/{job_id}/results/overall_buckets`

#### Path parameters

- `job_id` (string) — required
  Identifier for the anomaly detection job. It can be a job identifier, a
group name, a comma-separated list of jobs or groups, or a wildcard
expression.

You can summarize the bucket results for all anomaly detection jobs by
using `_all` or by specifying `*` as the `<job_id>`.

## Description

Retrievs overall bucket results that summarize the bucket results of
multiple anomaly detection jobs.

The `overall_score` is calculated by combining the scores of all the
buckets within the overall bucket span. First, the maximum
`anomaly_score` per anomaly detection job in the overall bucket is
calculated. Then the `top_n` of those scores are averaged to result in
the `overall_score`. This means that you can fine-tune the
`overall_score` so that it is more or less sensitive to the number of
jobs that detect an anomaly at the same time. For example, if you set
`top_n` to `1`, the `overall_score` is the maximum bucket score in the
overall bucket. Alternatively, if you set `top_n` to the number of jobs,
the `overall_score` is high only when all jobs detect anomalies in that
overall bucket. If you set the `bucket_span` parameter (to a value
greater than its default), the `overall_score` is the maximum
`overall_score` of the overall buckets that have a span equal to the
jobs' largest bucket span.

## Required authorization

- Cluster privileges: `monitor_ml`

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs use key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  For more information about where to find API keys for the Elasticsearch endpoint (${ES_URL}) for a project, go to [Get started with Elasticsearch Serverless](https://www.elastic.co/docs/solutions/search/serverless-elasticsearch-get-started).

## Query string parameters

- `allow_no_match` (boolean · default: true) — optional
  Specifies what to do when the request:

1. Contains wildcard expressions and there are no jobs that match.
2. Contains the `_all` string or no identifiers and there are no matches.
3. Contains wildcard expressions and there are only partial matches.

If `true`, the request returns an empty `jobs` array when there are no
matches and the subset of results when there are partial matches. If this
parameter is `false`, the request returns a `404` status code when there
are no matches or only partial matches.
- `bucket_span` (string) — optional
  The span of the overall buckets. Must be greater or equal to the largest
bucket span of the specified anomaly detection jobs, which is the default
value.

By default, an overall bucket has a span equal to the largest bucket span
of the specified anomaly detection jobs. To override that behavior, use
the optional `bucket_span` parameter.
- `end` (union oneOf) — optional
  Returns overall buckets with timestamps earlier than this time.
  One of: `string` or `number`
- `exclude_interim` (boolean · default: false) — optional
  If `true`, the output excludes interim results.
- `overall_score` (number) — optional
  Returns overall buckets with overall scores greater than or equal to this
value.
- `start` (union oneOf) — optional
  Returns overall buckets with timestamps after this time.
  One of: `string` or `number`
- `top_n` (number · default: 1) — optional
  The number of top anomaly detection job bucket scores to be used in the
`overall_score` calculation.

## Request body

`application/json`

- `allow_no_match` (boolean · default: true) — optional
  Refer to the description for the `allow_no_match` query parameter.
- `bucket_span` (string) — optional
  Refer to the description for the `bucket_span` query parameter.
- `end` (union) — optional
  Refer to the description for the `end` query parameter.
- `exclude_interim` (boolean · default: false) — optional
  Refer to the description for the `exclude_interim` query parameter.
- `overall_score` (number) — optional
  Refer to the description for the `overall_score` query parameter.
- `start` (union) — optional
  Refer to the description for the `start` query parameter.
- `top_n` (number · default: 1) — optional
  Refer to the description for the `top_n` query parameter.

## Response

`application/json`

- `count` (number)
- `overall_buckets` (object[])
  Array of overall bucket objects
  - `bucket_span` (number)
    The length of the bucket in seconds. Matches the job with the longest bucket_span value.
  - `is_interim` (boolean)
    If true, this is an interim result. In other words, the results are calculated based on partial input data.
  - `jobs` (object[])
    An array of objects that contain the max_anomaly_score per job_id.
    - `job_id` (string)
    - `max_anomaly_score` (number)
  - `overall_score` (number)
    The top_n average of the maximum bucket anomaly_score per job.
  - `result_type` (string)
    Internal. This is always set to overall_bucket.
  - `timestamp` (number)
    The start time of the bucket for which these results were calculated.
  - `timestamp_string` (union)
    The start time of the bucket for which these results were calculated.
## Code examples

#### Console

```console
POST _ml/anomaly_detectors/job-*/results/overall_buckets
{
  "overall_score": 80,
  "start": "1403532000000"
}
```

#### JavaScript

```javascript
const response = await client.ml.getOverallBuckets({
  job_id: "job-*",
  overall_score: 80,
  start: 1403532000000,
});
```

#### Python

```python
resp = client.ml.get_overall_buckets(
    job_id="job-*",
    overall_score=80,
    start="1403532000000",
)
```

#### curl

```curl
curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-*/results/overall_buckets" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "overall_score": 80,
    "start": "1403532000000"
  }'
```

#### Java

```java
client.ml().getOverallBuckets(g -> g
    .jobId("job-*")
    .overallScore(80.0D)
    .start(DateTime.of("1403532000000"))
);
```

#### C#

```c#
var response = await client.MachineLearning
    .GetOverallBucketsAsync(jobId: "job-*", d1 => d1
        .OverallScore(80d)
        .Start(DateTimeOffset.Parse("2014-06-23T14:00:00.0000000+00:00", CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind))
    );
```

#### PHP

```php
$resp = $client->ml()->getOverallBuckets([
    "job_id" => "job-*",
    "body" => [
        "overall_score" => 80,
        "start" => "1403532000000",
    ],
]);
```

#### Ruby

```ruby
response = client.ml.get_overall_buckets(
  job_id: "job-*",
  body: {
    "overall_score": 80,
    "start": "1403532000000"
  }
)
```