Get overall bucket results Added in 6.1.0
Retrievs overall bucket results that summarize the bucket results of multiple anomaly detection jobs.
The overall_score
is calculated by combining the scores of all the
buckets within the overall bucket span. First, the maximum
anomaly_score
per anomaly detection job in the overall bucket is
calculated. Then the top_n
of those scores are averaged to result in
the overall_score
. This means that you can fine-tune the
overall_score
so that it is more or less sensitive to the number of
jobs that detect an anomaly at the same time. For example, if you set
top_n
to 1
, the overall_score
is the maximum bucket score in the
overall bucket. Alternatively, if you set top_n
to the number of jobs,
the overall_score
is high only when all jobs detect anomalies in that
overall bucket. If you set the bucket_span
parameter (to a value
greater than its default), the overall_score
is the maximum
overall_score
of the overall buckets that have a span equal to the
jobs' largest bucket span.
Path parameters
-
Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression.
You can summarize the bucket results for all anomaly detection jobs by using
_all
or by specifying*
as the<job_id>
.
Query parameters
-
allow_no_match boolean
Specifies what to do when the request:
- Contains wildcard expressions and there are no jobs that match.
- Contains the
_all
string or no identifiers and there are no matches. - Contains wildcard expressions and there are only partial matches.
If
true
, the request returns an emptyjobs
array when there are no matches and the subset of results when there are partial matches. If this parameter isfalse
, the request returns a404
status code when there are no matches or only partial matches. -
bucket_span string
The span of the overall buckets. Must be greater or equal to the largest bucket span of the specified anomaly detection jobs, which is the default value.
By default, an overall bucket has a span equal to the largest bucket span of the specified anomaly detection jobs. To override that behavior, use the optional
bucket_span
parameter. -
end string | number
Returns overall buckets with timestamps earlier than this time.
-
exclude_interim boolean
If
true
, the output excludes interim results. -
overall_score number | string
Returns overall buckets with overall scores greater than or equal to this value.
-
start string | number
Returns overall buckets with timestamps after this time.
-
top_n number
The number of top anomaly detection job bucket scores to be used in the
overall_score
calculation.
Body
-
allow_no_match boolean
Refer to the description for the
allow_no_match
query parameter. -
bucket_span string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
exclude_interim boolean
Refer to the description for the
exclude_interim
query parameter. overall_score number | string
Refer to the description for the
overall_score
query parameter.-
top_n number
Refer to the description for the
top_n
query parameter.
curl \
-X POST http://api.example.com/_ml/anomaly_detectors/{job_id}/results/overall_buckets \
-H "Content-Type: application/json" \
-d '{"allow_no_match":true,"bucket_span":"string","":"string","exclude_interim":true,"overall_score":42.0,"top_n":42.0}'
{
"allow_no_match": true,
"bucket_span": "string",
"": "string",
"exclude_interim": true,
"overall_score": 42.0,
"top_n": 42.0
}
{
"count": 42.0,
"overall_buckets": [
{
"": "string",
"is_interim": true,
"jobs": [
{
"job_id": "string",
"max_anomaly_score": 42.0
}
],
"overall_score": 42.0,
"result_type": "string"
}
]
}