Get anomaly detection job stats

  • GET /_ml/anomaly_detectors/{job_id}/_stats
  • GET /_ml/anomaly_detectors/_stats
Auth

Required authorization

Cluster privileges monitor_ml

Path parameters

job_id string optional

Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs, or a wildcard expression. If you do not specify one of these options, the API returns information for all anomaly detection jobs.

Leave it out to use /_ml/anomaly_detectors/_stats.

Query parameters

allow_no_match boolean · default: true

Specifies what to do when the request:

  1. Contains wildcard expressions and there are no jobs that match.
  2. Contains the _all string or no identifiers and there are no matches.
  3. Contains wildcard expressions and there are only partial matches.

If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

Response

application/json
count number required
jobs object[] required
assignment_explanation string

For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

data_counts object required

An object that describes the quantity of input to the job and any related error counts. The data_count values are cumulative for the lifetime of a job. If a model snapshot is reverted or old results are deleted, the job counts are not reset.

bucket_count number required
earliest_record_timestamp number
empty_bucket_count number required
input_bytes number required
input_field_count number required
input_record_count number required
invalid_date_count number required
job_id string required
last_data_time number
latest_empty_bucket_timestamp number
latest_record_timestamp number
latest_sparse_bucket_timestamp number
latest_bucket_timestamp number
log_time number
missing_field_count number required
out_of_order_timestamp_count number required
processed_field_count number required
processed_record_count number required
sparse_bucket_count number required
forecasts_stats object required

An object that provides statistical information about forecasts belonging to this job. Some statistics are omitted if no forecasts have been made.

memory_bytes object
avg number required
max number required
min number required
total number required
processing_time_ms object
avg number required
max number required
min number required
total number required
records object
avg number required
max number required
min number required
total number required
status map string to number
total number required
forecasted_jobs number required
job_id string required

Identifier for the anomaly detection job.

model_size_stats object required

An object that provides information about the size and contents of the model.

bucket_allocation_failures_count number required
job_id string required
log_time union oneOf required
One of: string or number
memory_status enum required
Values: ok soft_limit hard_limit
model_bytes number | string required
model_bytes_exceeded number | string
model_bytes_memory_limit number | string
output_memory_allocator_bytes number | string
peak_model_bytes number | string
assignment_memory_basis string
result_type string required
total_by_field_count number required
total_over_field_count number required
total_partition_field_count number required
categorization_status enum required
Values: ok warn
categorized_doc_count number required
dead_category_count number required
failed_category_count number required
frequent_category_count number required
rare_category_count number required
total_category_count number required
timestamp number
node object

Contains properties for the node that runs the job. This information is available only for open jobs.

name string required
ephemeral_id string required
id string required
transport_address string required
attributes map string to string required
open_time union oneOf

For open jobs only, the elapsed time for which the job has been open.

One of: string or number
state enum required

The status of the anomaly detection job, which can be one of the following values: closed, closing, failed, opened, opening.

Supported values include:

  • closing: The job close action is in progress and has not yet completed. A closing job cannot accept further data.
  • closed: The job finished successfully with its model state persisted. The job must be opened before it can accept further data.
  • opened: The job is available to receive and process data.
  • failed: The job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened.
  • opening: The job open action is in progress and has not yet completed.
Values: closing closed opened failed opening
timing_stats object required

An object that provides statistical information about timing aspect of this job.

average_bucket_processing_time_ms number
bucket_count number required
exponential_average_bucket_processing_time_ms number
exponential_average_bucket_processing_time_per_hour_ms number required
job_id string required
total_bucket_processing_time_ms number required
maximum_bucket_processing_time_ms number
minimum_bucket_processing_time_ms number
deleting boolean

Indicates that the process of deleting the job is in progress but not yet completed. It is only reported when true.