Get anomaly detection job results for influencers

  • POST also GET /_ml/anomaly_detectors/{job_id}/results/influencers
Auth

Influencers are the entities that have contributed to, or are to blame for, the anomalies. Influencer results are available only if an influencer_field_name is specified in the job configuration.

Required authorization

Cluster privileges monitor_ml

Path parameters

job_id string required

Identifier for the anomaly detection job.

Query parameters

desc boolean · default: false

If true, the results are sorted in descending order.

end union oneOf · default: -1

Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.

One of: string or number
exclude_interim boolean · default: false

If true, the output excludes interim results. By default, interim results are included.

influencer_score number · default: 0

Returns influencers with anomaly scores greater than or equal to this value.

from number · default: 0

Skips the specified number of influencers.

size number · default: 100

Specifies the maximum number of influencers to obtain.

sort string

Specifies the sort field for the requested influencers. By default, the influencers are sorted by the influencer_score value.

start union oneOf · default: -1

Returns influencers with timestamps after this time. The default value means it is unset and results are not limited to specific timestamps.

One of: string or number

Request body

page object

Configures pagination. This parameter has the from and size properties.

from number · default: 0

Skips the specified number of items.

size number · default: 10000

Specifies the maximum number of items to obtain.

Response

application/json
count number required
influencers object[] required

Array of influencer objects

bucket_span number required

The length of the bucket in seconds. This value matches the bucket span that is specified in the job.

influencer_score number required

A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated across detectors. Unlike initial_influencer_score, this value is updated by a re-normalization process as new data is analyzed.

influencer_field_name string required

The field name of the influencer.

influencer_field_value string required

The entity that influenced, contributed to, or was to blame for the anomaly.

initial_influencer_score number required

A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors. This is the initial value that was calculated at the time the bucket was processed.

is_interim boolean required

If true, this is an interim result. In other words, the results are calculated based on partial input data.

job_id string required

Identifier for the anomaly detection job.

probability number required

The probability that the influencer has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the influencer_score is provided as a human-readable and friendly interpretation of this value.

result_type string required

Internal. This value is always set to influencer.

timestamp number required

The start time of the bucket for which these results were calculated.

foo string

Additional influencer properties are added, depending on the fields being analyzed. For example, if it’s analyzing user_name as an influencer, a field user_name is added to the result document. This information enables you to filter the anomaly results more easily.