honeymoose
/
OpenSearch
mirror of https://github.com/honeymoose/OpenSearch.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[DOCS] Small fixes in the overall buckets API (elastic/x-pack-elasticsearch#2732) 

* [DOCS] Small fixes in the overall buckets API

* [DOCS] Addressed feedback in overall buckets API

Original commit: elastic/x-pack-elasticsearch@4f79bc9a50
This commit is contained in:
Lisa Cawley 2017-10-11 16:24:09 +01:00 committed by lcawley
parent 723dd49905
commit 2455415a04
1 changed files with 41 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
docs/en/rest-api/ml/get-overall-buckets.asciidoc
View File

@ -7,56 +7,62 @@ that summarize the bucket results of multiple jobs.
==== Request ==== Request
`GET _xpack/ml/anomaly_detectors/<job_id>/results/overall_buckets` `GET _xpack/ml/anomaly_detectors/<job_id>/results/overall_buckets` +
`GET _xpack/ml/anomaly_detectors/<job_id>,<job_id>/results/overall_buckets` +
`GET _xpack/ml/anomaly_detectors/_all/results/overall_buckets`
==== Description ==== Description
An overall bucket has a span equal to the largest job's `bucket_span`. You can summarize the bucket results for all jobs by using `_all` or by
The `overall_score` is calculated by combining the scores of all the specifying `*` as the `<job_id>`.
buckets within the overall bucket span. The max `anomaly_score` per
job is calculated. Then the `top_n` of those scores are averaged to
result into the `overall_score`. This means that you can fine-tune
the `overall_score` so that it is more or less sensitive to the number
of jobs that detect an anomaly at the same time.
For example, set `top_n` to 1 and the `overall_score` will be the An overall bucket has a span equal to the largest `bucket_span` value for the
max bucket score in the overall bucket interval. To the contrary, specified jobs.
set `top_n` to the number of jobs and the `overall_score` will
only be high when all jobs present anomalies in that overall bucket. The `overall_score` is calculated by combining the scores of all
the buckets within the overall bucket span. First, the maximum `anomaly_score` per
job in the overall bucket is calculated. Then the `top_n` of those scores are
averaged to result in the `overall_score`. This means that you can fine-tune
the `overall_score` so that it is more or less sensitive to the number
of jobs that detect an anomaly at the same time. For example, if you set `top_n`
to `1`, the `overall_score` is the maximum bucket
score in the overall bucket. Alternatively, if you set `top_n` to the number of
jobs, the `overall_score` is high only when all jobs detect anomalies in that
overall bucket.
==== Path Parameters ==== Path Parameters
`job_id`:: `job_id`::
(string) Identifier for the job. It can be a job identifier, a group name, (string) Identifier for the job. It can be a job identifier, a group name, a
or a wildcard expression. If set to `_all`, the API returns overall buckets comma-separated list of jobs or groups, or a wildcard expression.
for all jobs.
==== Request Body ==== Request Body
`top_n`::
(integer) The number of top job bucket scores to be used in the
`overall_score` calculation. The default value is `1`.
`overall_score`::
(double) Returns overall buckets with overall scores higher than this value.
`exclude_interim`::
(boolean) If true, the output excludes interim overall buckets.
Overall buckets are interim if any of the job buckets within
the overall bucket interval is interim.
By default, interim results are included.
`start`::
(string) Returns overall buckets with timestamps after this time.
`end`::
(string) Returns overall buckets with timestamps earlier than this time.
`allow_no_jobs`:: `allow_no_jobs`::
(boolean) If `false` and the `job_id` does not match any job an error will (boolean) If `false` and the `job_id` does not match any job an error will
be returned. The default value is `true`. be returned. The default value is `true`.
`end`::
(string) Returns overall buckets with timestamps earlier than this time.
`exclude_interim`::
(boolean) If `true`, the output excludes interim overall buckets.
Overall buckets are interim if any of the job buckets within
the overall bucket interval are interim.
By default, interim results are included.
`overall_score`::
(double) Returns overall buckets with overall scores higher than this value.
`start`::
(string) Returns overall buckets with timestamps after this time.
`top_n`::
(integer) The number of top job bucket scores to be used in the
`overall_score` calculation. The default value is `1`.
===== Results ===== Results