Get anomaly detection job results for influencers
- POST also GET /_ml/anomaly_detectors/{job_id}/results/influencers
Influencers are the entities that have contributed to, or are to blame for,
the anomalies. Influencer results are available only if an
influencer_field_name is specified in the job configuration.
Required authorization
- Cluster privileges monitor_ml
Query parameters
-
endunion · default: -1 -
Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.
-
exclude_interimboolean · default: false -
If true, the output excludes interim results. By default, interim results are included.
-
influencer_scorenumber · default: 0 -
Returns influencers with anomaly scores greater than or equal to this value.
Response
-
influencersobjectrequired -
Array of influencer objects
-
bucket_spannumberrequired -
The length of the bucket in seconds. This value matches the bucket span that is specified in the job.
-
influencer_scorenumberrequired -
A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated across detectors. Unlike
initial_influencer_score, this value is updated by a re-normalization process as new data is analyzed. -
influencer_field_valuestringrequired -
The entity that influenced, contributed to, or was to blame for the anomaly.
-
initial_influencer_scorenumberrequired -
A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors. This is the initial value that was calculated at the time the bucket was processed.
-
is_interimbooleanrequired -
If true, this is an interim result. In other words, the results are calculated based on partial input data.