Retrieves job results for one or more buckets.
GET _ml/anomaly_detectors/<job_id>/results/buckets
GET _ml/anomaly_detectors/<job_id>/results/buckets/<timestamp>
job_id
timestamp
anomaly_score
desc
end
exclude_interim
expand
page
from
size
sort
timestamp
field.
start
The API returns the following information:
buckets
You must have monitor_ml
, monitor
, manage_ml
, or manage
cluster
privileges to use this API. You also need read
index privilege on the index
that stores the results. The machine_learning_admin
and machine_learning_user
roles provide these privileges. For more information, see
Security Privileges and
Built-in Roles.
The following example gets bucket information for the it-ops-kpi
job:
GET _ml/anomaly_detectors/it-ops-kpi/results/buckets { "anomaly_score": 80, "start": "1454530200001" }
In this example, the API returns a single result that matches the specified score and time constraints:
{ "count": 1, "buckets": [ { "job_id": "it-ops-kpi", "timestamp": 1454943900000, "anomaly_score": 94.1706, "bucket_span": 300, "initial_anomaly_score": 94.1706, "event_count": 153, "is_interim": false, "bucket_influencers": [ { "job_id": "it-ops-kpi", "result_type": "bucket_influencer", "influencer_field_name": "bucket_time", "initial_anomaly_score": 94.1706, "anomaly_score": 94.1706, "raw_anomaly_score": 2.32119, "probability": 0.00000575042, "timestamp": 1454943900000, "bucket_span": 300, "is_interim": false } ], "processing_time_ms": 2, "partition_scores": [], "result_type": "bucket" } ] }