This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Reset anomaly detection jobs API Start datafeeds API »

› › ›

Revert model snapshots API

edit

Revert model snapshots API

edit

Reverts to a specific snapshot.

Request

edit

POST _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>/_revert

Prerequisites

edit

Before you revert to a saved snapshot, you must close the job.
Requires the manage_ml cluster privilege. This privilege is included in the machine_learning_admin built-in role.

Description

edit

The machine learning features react quickly to anomalous input, learning new behaviors in data. Highly anomalous input increases the variance in the models whilst the system learns whether this is a new step-change in behavior or a one-off event. In the case where this anomalous input is known to be a one-off, then it might be appropriate to reset the model state to a time before this event. For example, you might consider reverting to a saved snapshot after Black Friday or a critical system failure.

Reverting to a snapshot does not change the data_counts values of the anomaly detection job, these values are not reverted to the earlier state.

Path parameters

edit

<job_id>

(Required, string) Identifier for the anomaly detection job.

<snapshot_id>

(Required, string) Identifier for the model snapshot.

You can specify empty as the <snapshot_id>. Reverting to the empty snapshot means the anomaly detection job starts learning a new model from scratch when it is started.

Query parameters

edit

delete_intervening_results: (Optional, Boolean) If true, deletes the results in the time period between the latest results and the time of the reverted snapshot. It also resets the model to accept records for this time period. The default value is false.

If you choose not to delete intervening results when reverting a snapshot, the job will not accept input data that is older than the current time. If you want to resend data, then delete the intervening results.

Request body

edit

You can also specify the delete_intervening_results query parameter in the request body.

Examples

edit

resp = client.ml.revert_model_snapshot(
    job_id="low_request_rate",
    snapshot_id="1637092688",
    delete_intervening_results=True,
)
print(resp)

response = client.ml.revert_model_snapshot(
  job_id: 'low_request_rate',
  snapshot_id: 1_637_092_688,
  body: {
    delete_intervening_results: true
  }
)
puts response

const response = await client.ml.revertModelSnapshot({
  job_id: "low_request_rate",
  snapshot_id: 1637092688,
  delete_intervening_results: true,
});
console.log(response);

POST _ml/anomaly_detectors/low_request_rate/model_snapshots/1637092688/_revert
{
  "delete_intervening_results": true
}

When the operation is complete, you receive the following results:

{
  "model" : {
    "job_id" : "low_request_rate",
    "min_version" : "7.11.0",
    "timestamp" : 1637092688000,
    "description" : "State persisted due to job close at 2021-11-16T19:58:08+0000",
    "snapshot_id" : "1637092688",
    "snapshot_doc_count" : 1,
    "model_size_stats" : {
      "job_id" : "low_request_rate",
      "result_type" : "model_size_stats",
      "model_bytes" : 45200,
      "peak_model_bytes" : 101552,
      "model_bytes_exceeded" : 0,
      "model_bytes_memory_limit" : 11534336,
      "total_by_field_count" : 3,
      "total_over_field_count" : 0,
      "total_partition_field_count" : 2,
      "bucket_allocation_failures_count" : 0,
      "memory_status" : "ok",
      "assignment_memory_basis" : "current_model_bytes",
      "categorized_doc_count" : 0,
      "total_category_count" : 0,
      "frequent_category_count" : 0,
      "rare_category_count" : 0,
      "dead_category_count" : 0,
      "failed_category_count" : 0,
      "categorization_status" : "ok",
      "log_time" : 1637092688530,
      "timestamp" : 1641495600000
    },
    "latest_record_time_stamp" : 1641502169000,
    "latest_result_time_stamp" : 1641495600000,
    "retain" : false
  }
}

For a description of these properties, see the get model snapshots API.

« Reset anomaly detection jobs API Start datafeeds API »