Create a filter

PUT /_ml/filters/{filter_id}

Auth

A filter contains a list of strings. It can be used by one or more anomaly detection jobs. Specifically, filters are referenced in the custom_rules property of detector configuration objects.

Required privileges

Cluster privileges manage_ml

Path parameters

filter_id string required: A string that uniquely identifies a filter.

Request body

description string: A description of the filter.
items string[]: The items of the filter. A wildcard * can be used at the beginning or the end of an item. Up to 10000 items are allowed in each filter.

Response

application/json

description string required
filter_id string required
items string[] required

View as Markdown

Examples

Request Console 1 / 8 languages

An example body for a PUT _ml/filters/safe_domains request.

Console Kibana Dev Tools

PUT _ml/filters/safe_domains
{
  "description": "A list of safe domains",
  "items": ["*.google.com", "wikipedia.org"]
}

JavaScript Elasticsearch JavaScript Client

const response = await client.ml.putFilter({
  filter_id: "safe_domains",
  description: "A list of safe domains",
  items: ["*.google.com", "wikipedia.org"],
});

Python Elasticsearch Python Client

resp = client.ml.put_filter(
    filter_id="safe_domains",
    description="A list of safe domains",
    items=[
        "*.google.com",
        "wikipedia.org"
    ],
)

curl Shell

curl -X PUT "$ELASTICSEARCH_URL/_ml/filters/safe_domains" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "A list of safe domains",
    "items": [
      "*.google.com",
      "wikipedia.org"
    ]
  }'

Java Elasticsearch Java Client

client.ml().putFilter(p -> p
    .description("A list of safe domains")
    .filterId("safe_domains")
    .items(List.of("*.google.com","wikipedia.org"))
);

C# Elasticsearch .NET Client

var response = await client.MachineLearning
    .PutFilterAsync(filterId: "safe_domains", d1 => d1
        .Description("A list of safe domains")
        .Items("*.google.com", "wikipedia.org")
    );

PHP Elasticsearch PHP Client

$resp = $client->ml()->putFilter([
    "filter_id" => "safe_domains",
    "body" => [
        "description" => "A list of safe domains",
        "items" => array(
            "*.google.com",
            "wikipedia.org",
        ),
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.ml.put_filter(
  filter_id: "safe_domains",
  body: {
    "description": "A list of safe domains",
    "items": [
      "*.google.com",
      "wikipedia.org"
    ]
  }
)

Response

{
  "description": "string",
  "filter_id": "string",
  "items": [
    "string"
  ]
}

Generated from the API spec

Required privileges

Path parameters

Request body { }

Response

Request body