Get anomaly detection job results for buckets

  • POST also GET /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}
  • POST also GET /_ml/anomaly_detectors/{job_id}/results/buckets
Auth

The API presents a chronological view of the records, grouped by bucket.

Required authorization

Cluster privileges monitor_ml

Path parameters

job_id string required

Identifier for the anomaly detection job.

timestamp union oneOf optional

The timestamp of a single bucket result. If you do not specify this parameter, the API returns information about all buckets.

Leave it out to use /_ml/anomaly_detectors/{job_id}/results/buckets.

One of: string or number

Query parameters

anomaly_score number · default: 0

Returns buckets with anomaly scores greater or equal than this value.

desc boolean · default: false

If true, the buckets are sorted in descending order.

end union oneOf · default: -1

Returns buckets with timestamps earlier than this time. -1 means it is unset and results are not limited to specific timestamps.

One of: string or number
exclude_interim boolean · default: false

If true, the output excludes interim results.

expand boolean · default: false

If true, the output includes anomaly records.

from number · default: 0

Skips the specified number of buckets.

size number · default: 100

Specifies the maximum number of buckets to obtain.

sort string · default: timestamp

Specifies the sort field for the requested buckets.

start union oneOf · default: -1

Returns buckets with timestamps after this time. -1 means it is unset and results are not limited to specific timestamps.

One of: string or number

Request body

anomaly_score number · default: 0

Refer to the description for the anomaly_score query parameter.

desc boolean · default: false

Refer to the description for the desc query parameter.

end union oneOf · default: -1

Refer to the description for the end query parameter.

One of: string or number
exclude_interim boolean · default: false

Refer to the description for the exclude_interim query parameter.

expand boolean · default: false

Refer to the description for the expand query parameter.

page object
from number · default: 0

Skips the specified number of items.

size number · default: 10000

Specifies the maximum number of items to obtain.

sort string · default: timestamp

Refer to the desription for the sort query parameter.

start union oneOf · default: -1

Refer to the description for the start query parameter.

One of: string or number

Response

application/json
buckets object[] required
anomaly_score number required

The maximum anomaly score, between 0-100, for any of the bucket influencers. This is an overall, rate-limited score for the job. All the anomaly records in the bucket contribute to this score. This value might be updated as new data is analyzed.

bucket_influencers object[] required
anomaly_score number required

A normalized score between 0-100, which is calculated for each bucket influencer. This score might be updated as newer data is analyzed.

bucket_span number required

The length of the bucket in seconds. This value matches the bucket span that is specified in the job.

influencer_field_name string required

The field name of the influencer.

initial_anomaly_score number required

The score between 0-100 for each bucket influencer. This score is the initial value that was calculated at the time the bucket was processed.

is_interim boolean required

If true, this is an interim result. In other words, the results are calculated based on partial input data.

job_id string required

Identifier for the anomaly detection job.

probability number required

The probability that the bucket has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the anomaly_score is provided as a human-readable and friendly interpretation of this.

raw_anomaly_score number required

Internal.

result_type string required

Internal. This value is always set to bucket_influencer.

timestamp number required

The start time of the bucket for which these results were calculated.

timestamp_string union oneOf

The start time of the bucket for which these results were calculated.

One of: string or number
bucket_span number required

The length of the bucket in seconds. This value matches the bucket span that is specified in the job.

event_count number required

The number of input data records processed in this bucket.

initial_anomaly_score number required

The maximum anomaly score for any of the bucket influencers. This is the initial value that was calculated at the time the bucket was processed.

is_interim boolean required

If true, this is an interim result. In other words, the results are calculated based on partial input data.

job_id string required

Identifier for the anomaly detection job.

processing_time_ms number required

The amount of time, in milliseconds, that it took to analyze the bucket contents and calculate results.

result_type string required

Internal. This value is always set to bucket.

timestamp number required

The start time of the bucket. This timestamp uniquely identifies the bucket. Events that occur exactly at the timestamp of the bucket are included in the results for the bucket.

timestamp_string union oneOf

The start time of the bucket. This timestamp uniquely identifies the bucket. Events that occur exactly at the timestamp of the bucket are included in the results for the bucket.

One of: string or number
count number required