Get overall bucket results

POST also GET /_ml/anomaly_detectors/{job_id}/results/overall_buckets

Auth

Retrievs overall bucket results that summarize the bucket results of multiple anomaly detection jobs.

The overall_score is calculated by combining the scores of all the buckets within the overall bucket span. First, the maximum anomaly_score per anomaly detection job in the overall bucket is calculated. Then the top_n of those scores are averaged to result in the overall_score. This means that you can fine-tune the overall_score so that it is more or less sensitive to the number of jobs that detect an anomaly at the same time. For example, if you set top_n to 1, the overall_score is the maximum bucket score in the overall bucket. Alternatively, if you set top_n to the number of jobs, the overall_score is high only when all jobs detect anomalies in that overall bucket. If you set the bucket_span parameter (to a value greater than its default), the overall_score is the maximum overall_score of the overall buckets that have a span equal to the jobs' largest bucket span.

Required privileges

Cluster privileges monitor_ml

Path parameters

job_id string required

Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression.

You can summarize the bucket results for all anomaly detection jobs by using _all or by specifying * as the <job_id>.

Query parameters

allow_no_match boolean · default: true

Specifies what to do when the request:

Contains wildcard expressions and there are no jobs that match.
Contains the _all string or no identifiers and there are no matches.
Contains wildcard expressions and there are only partial matches.

If true, the request returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If this parameter is false, the request returns a 404 status code when there are no matches or only partial matches.

bucket_span union oneOf

The span of the overall buckets. Must be greater or equal to the largest bucket span of the specified anomaly detection jobs, which is the default value.

By default, an overall bucket has a span equal to the largest bucket span of the specified anomaly detection jobs. To override that behavior, use the optional bucket_span parameter.

Values: -1 0

Reference

end union oneOf

Returns overall buckets with timestamps earlier than this time.

One of: string or number

exclude_interim boolean · default: false

If true, the output excludes interim results.

overall_score number

Returns overall buckets with overall scores greater than or equal to this value.

start union oneOf

Returns overall buckets with timestamps after this time.

One of: string or number

top_n number · default: 1

The number of top anomaly detection job bucket scores to be used in the overall_score calculation.

Request body

allow_no_match boolean · default: true: Refer to the description for the allow_no_match query parameter.
bucket_span union oneOf: Refer to the description for the bucket_span query parameter.; Values: -1 0
end union oneOf: Refer to the description for the end query parameter.; One of: string or number
exclude_interim boolean · default: false: Refer to the description for the exclude_interim query parameter.
overall_score number: Refer to the description for the overall_score query parameter.
start union oneOf: Refer to the description for the start query parameter.; One of: string or number
top_n number · default: 1: Refer to the description for the top_n query parameter.

Response

application/json

count number required
overall_buckets object[] required: Array of overall bucket objects