Flush Jobs

POST _xpack/ml/anomaly_detectors/<job_id>/_flush

The flush job API is only applicable when sending data for analysis using the post data API. Depending on the content of the buffer, then it might additionally calculate new results.

Both flush and close operations are similar, however the flush is more efficient if you are expecting to send more data for analysis. When flushing, the job remains open and is available to continue analyzing data. A close operation additionally prunes and persists the model state to disk and the job must be opened again before analyzing further data.

You must have manage_ml, or manage cluster privileges to use this API. For more information, see Security Privileges.

The following example flushes the total-requests job:

POST _xpack/ml/anomaly_detectors/total-requests/_flush
{
  "calc_interim": true
}

When the operation succeeds, you receive the following results:

{
  "flushed": true,
  "last_finalized_bucket_end": 1455234900000
}

The last_finalized_bucket_end provides the timestamp (in milliseconds-since-the-epoch) of the end of the last bucket that was processed.

If you want to flush the job to a specific timestamp, you can use the advance_time or skip_time parameters. For example, to advance to 11 AM GMT on January 1, 2018:

POST _xpack/ml/anomaly_detectors/total-requests/_flush
{
  "advance_time": "1514804400"
}

When the operation succeeds, you receive the following results:

{
  "flushed": true,
  "last_finalized_bucket_end": 1514804400000
}