[DOCS] Remove data type formatting from API pages
Original commit: elastic/x-pack-elasticsearch@fb06ece3f0
This commit is contained in:
parent
1a6f813d5a
commit
412bb63383
|
@ -28,12 +28,12 @@ operations, but you can still explore and navigate results.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
===== Query Parameters
|
===== Query Parameters
|
||||||
|
|
||||||
`close_timeout`::
|
`close_timeout`::
|
||||||
(+time+) Controls the time to wait until a job has closed.
|
(time) Controls the time to wait until a job has closed.
|
||||||
The default value is 30 minutes.
|
The default value is 30 minutes.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -5,7 +5,7 @@
|
||||||
A data feed resource has the following properties:
|
A data feed resource has the following properties:
|
||||||
|
|
||||||
`aggregations`::
|
`aggregations`::
|
||||||
(+object+) TBD
|
(object) TBD
|
||||||
The aggregations object describes the aggregations that are
|
The aggregations object describes the aggregations that are
|
||||||
applied to the search query?
|
applied to the search query?
|
||||||
For more information, see {ref}search-aggregations.html[Aggregations].
|
For more information, see {ref}search-aggregations.html[Aggregations].
|
||||||
|
@ -16,23 +16,23 @@ A data feed resource has the following properties:
|
||||||
"field": "events_per_min"}}}}}`.
|
"field": "events_per_min"}}}}}`.
|
||||||
|
|
||||||
`chunking_config`::
|
`chunking_config`::
|
||||||
(+object+) TBD.
|
(object) TBD.
|
||||||
For example: {"mode": "manual", "time_span": "30000000ms"}
|
For example: {"mode": "manual", "time_span": "30000000ms"}
|
||||||
|
|
||||||
`datafeed_id`::
|
`datafeed_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the data feed.
|
(string) A numerical character string that uniquely identifies the data feed.
|
||||||
|
|
||||||
`frequency`::
|
`frequency`::
|
||||||
TBD. For example: "150s"
|
TBD. For example: "150s"
|
||||||
|
|
||||||
`indexes` (required)::
|
`indexes` (required)::
|
||||||
(+array+) An array of index names. For example: ["it_ops_metrics"]
|
(array) An array of index names. For example: ["it_ops_metrics"]
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`query`::
|
`query`::
|
||||||
(+object+) TBD. The query that retrieves the data.
|
(object) TBD. The query that retrieves the data.
|
||||||
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
||||||
|
|
||||||
`query_delay`::
|
`query_delay`::
|
||||||
|
@ -44,7 +44,7 @@ A data feed resource has the following properties:
|
||||||
The default value is `1000`.
|
The default value is `1000`.
|
||||||
|
|
||||||
`types` (required)::
|
`types` (required)::
|
||||||
(+array+) TBD. For example: ["network","sql","kpi"]
|
(array) TBD. For example: ["network","sql","kpi"]
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
[[ml-datafeed-counts]]
|
[[ml-datafeed-counts]]
|
||||||
|
@ -57,10 +57,10 @@ progress of a data feed. For example:
|
||||||
TBD. For example: " "
|
TBD. For example: " "
|
||||||
|
|
||||||
`datafeed_id`::
|
`datafeed_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the data feed.
|
(string) A numerical character string that uniquely identifies the data feed.
|
||||||
|
|
||||||
`node`::
|
`node`::
|
||||||
(+object+) TBD
|
(object) TBD
|
||||||
The node that is running the query?
|
The node that is running the query?
|
||||||
`id`::: TBD. For example, "0-o0tOoRTwKFZifatTWKNw".
|
`id`::: TBD. For example, "0-o0tOoRTwKFZifatTWKNw".
|
||||||
`name`::: TBD. For example, "0-o0tOo".
|
`name`::: TBD. For example, "0-o0tOo".
|
||||||
|
@ -69,7 +69,6 @@ progress of a data feed. For example:
|
||||||
`attributes`::: TBD. For example, {"max_running_jobs": "10"}.
|
`attributes`::: TBD. For example, {"max_running_jobs": "10"}.
|
||||||
|
|
||||||
`state`::
|
`state`::
|
||||||
(+string+) The status of the data feed,
|
(string) The status of the data feed, which can be one of the following values: +
|
||||||
which can be one of the following values:
|
started::: The data feed is actively receiving data.
|
||||||
started:: The data feed is actively receiving data.
|
stopped::: The data feed is stopped and will not receive data until it is re-started.
|
||||||
stopped:: The data feed is stopped and will not receive data until it is re-started.
|
|
||||||
|
|
|
@ -15,7 +15,7 @@ NOTE: You must stop the data feed before you can delete it.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) Identifier for the data feed
|
(string) Identifier for the data feed
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
||||||
|
|
|
@ -25,7 +25,7 @@ It is not currently possible to delete multiple jobs using wildcards or a comma
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
|
@ -19,10 +19,10 @@ first revert to a different one.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
`snapshot_id` (required)::
|
`snapshot_id` (required)::
|
||||||
(+string+) Identifier for the model snapshot
|
(string) Identifier for the model snapshot
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
||||||
|
|
|
@ -19,23 +19,23 @@ A close operation additionally prunes and persists the model state to disk and t
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
( +string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
===== Query Parameters
|
===== Query Parameters
|
||||||
|
|
||||||
`advance_time`::
|
`advance_time`::
|
||||||
(+string+) Specifies that no data prior to the date `advance_time` is expected.
|
(string) Specifies that no data prior to the date `advance_time` is expected.
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+string+) When used in conjunction with `calc_interim`, specifies the range
|
(string) When used in conjunction with `calc_interim`, specifies the range
|
||||||
of buckets on which to calculate interim results.
|
of buckets on which to calculate interim results.
|
||||||
|
|
||||||
`calc_interim`::
|
`calc_interim`::
|
||||||
(+boolean+) If true, calculates the interim results for the most recent bucket
|
(boolean) If true, calculates the interim results for the most recent bucket
|
||||||
or all buckets within the latency period.
|
or all buckets within the latency period.
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) When used in conjunction with `calc_interim`, specifies the range of
|
(string) When used in conjunction with `calc_interim`, specifies the range of
|
||||||
buckets on which to calculate interim results.
|
buckets on which to calculate interim results.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -18,46 +18,46 @@ This API presents a chronological view of the records, grouped by bucket.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+string+) The timestamp of a single bucket result.
|
(string) The timestamp of a single bucket result.
|
||||||
If you do not specify this optional parameter, the API returns information
|
If you do not specify this optional parameter, the API returns information
|
||||||
about all buckets that you have authority to view in the job.
|
about all buckets that you have authority to view in the job.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`anomaly_score`::
|
`anomaly_score`::
|
||||||
(+double+) Returns buckets with anomaly scores higher than this value.
|
(double) Returns buckets with anomaly scores higher than this value.
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+string+) Returns buckets with timestamps earlier than this time.
|
(string) Returns buckets with timestamps earlier than this time.
|
||||||
|
|
||||||
`expand`::
|
`expand`::
|
||||||
(+boolean+) If true, the output includes anomaly records.
|
(boolean) If true, the output includes anomaly records.
|
||||||
|
|
||||||
`from`::
|
`from`::
|
||||||
(+integer+) Skips the specified number of buckets.
|
(integer) Skips the specified number of buckets.
|
||||||
|
|
||||||
`include_interim`::
|
`include_interim`::
|
||||||
(+boolean+) If true, the output includes interim results.
|
(boolean) If true, the output includes interim results.
|
||||||
|
|
||||||
`partition_value`::
|
`partition_value`::
|
||||||
(+string+) If `expand` is true, the anomaly records are filtered by this
|
(string) If `expand` is true, the anomaly records are filtered by this
|
||||||
partition value.
|
partition value.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(+integer+) Specifies the maximum number of buckets to obtain.
|
(integer) Specifies the maximum number of buckets to obtain.
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) Returns buckets with timestamps after this time.
|
(string) Returns buckets with timestamps after this time.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`buckets`::
|
`buckets`::
|
||||||
(+array+) An array of bucket objects. For more information, see
|
(array) An array of bucket objects. For more information, see
|
||||||
<<ml-results-buckets,Buckets>>.
|
<<ml-results-buckets,Buckets>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -17,10 +17,10 @@ about the categories in the results for a job.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job.
|
(string) Identifier for the job.
|
||||||
|
|
||||||
`category_id`::
|
`category_id`::
|
||||||
(+string+) Identifier for the category. If you do not specify this optional parameter,
|
(string) Identifier for the category. If you do not specify this optional parameter,
|
||||||
the API returns information about all categories that you have authority to view.
|
the API returns information about all categories that you have authority to view.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
@ -28,17 +28,17 @@ about the categories in the results for a job.
|
||||||
//TBD: Test these properties, since they didn't work on older build.
|
//TBD: Test these properties, since they didn't work on older build.
|
||||||
|
|
||||||
`from`::
|
`from`::
|
||||||
(+integer+) Skips the specified number of categories.
|
(integer) Skips the specified number of categories.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(+integer+) Specifies the maximum number of categories to obtain.
|
(integer) Specifies the maximum number of categories to obtain.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`categories`::
|
`categories`::
|
||||||
(+array+) An array of category objects. For more information, see
|
(array) An array of category objects. For more information, see
|
||||||
<<ml-results-categories,Categories>>.
|
<<ml-results-categories,Categories>>.
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
|
@ -19,7 +19,7 @@ If the data feed is stopped, the only information you receive is the
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id`::
|
`feed_id`::
|
||||||
(+string+) Identifier for the data feed.
|
(string) Identifier for the data feed.
|
||||||
If you do not specify this optional parameter, the API returns information
|
If you do not specify this optional parameter, the API returns information
|
||||||
about all data feeds that you have authority to view.
|
about all data feeds that you have authority to view.
|
||||||
|
|
||||||
|
@ -28,7 +28,7 @@ If the data feed is stopped, the only information you receive is the
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`datafeeds`::
|
`datafeeds`::
|
||||||
(+array+) An array of data feed count objects.
|
(array) An array of data feed count objects.
|
||||||
For more information, see <<ml-datafeed-counts,Data Feed Counts>>.
|
For more information, see <<ml-datafeed-counts,Data Feed Counts>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -18,7 +18,7 @@ OUTDATED?: The get job API can also be applied to all jobs by using `_all` as th
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id`::
|
`feed_id`::
|
||||||
(+string+) Identifier for the data feed.
|
(string) Identifier for the data feed.
|
||||||
If you do not specify this optional parameter, the API returns information
|
If you do not specify this optional parameter, the API returns information
|
||||||
about all data feeds that you have authority to view.
|
about all data feeds that you have authority to view.
|
||||||
|
|
||||||
|
@ -27,7 +27,7 @@ OUTDATED?: The get job API can also be applied to all jobs by using `_all` as th
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`datafeeds`::
|
`datafeeds`::
|
||||||
(+array+) An array of data feed objects.
|
(array) An array of data feed objects.
|
||||||
For more information, see <<ml-datafeed-resource,data feed resources>>.
|
For more information, see <<ml-datafeed-resource,data feed resources>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -15,42 +15,42 @@ in a job.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job.
|
(string) Identifier for the job.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`desc`::
|
`desc`::
|
||||||
(+boolean+) If true, the results are sorted in descending order.
|
(boolean) If true, the results are sorted in descending order.
|
||||||
//TBD: Using the "sort" value?
|
//TBD: Using the "sort" value?
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+string+) Returns influencers with timestamps earlier than this time.
|
(string) Returns influencers with timestamps earlier than this time.
|
||||||
|
|
||||||
`from`::
|
`from`::
|
||||||
(+integer+) Skips the specified number of influencers.
|
(integer) Skips the specified number of influencers.
|
||||||
|
|
||||||
`include_interim`::
|
`include_interim`::
|
||||||
(+boolean+) If true, the output includes interim results.
|
(boolean) If true, the output includes interim results.
|
||||||
|
|
||||||
`influencer_score`::
|
`influencer_score`::
|
||||||
(+double+) Returns influencers with anomaly scores higher than this value.
|
(double) Returns influencers with anomaly scores higher than this value.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(+integer+) Specifies the maximum number of influencers to obtain.
|
(integer) Specifies the maximum number of influencers to obtain.
|
||||||
|
|
||||||
`sort`::
|
`sort`::
|
||||||
(+string+) Specifies the sort field for the requested influencers.
|
(string) Specifies the sort field for the requested influencers.
|
||||||
//TBD: By default the results are sorted on the influencer score?
|
//TBD: By default the results are sorted on the influencer score?
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) Returns influencers with timestamps after this time.
|
(string) Returns influencers with timestamps after this time.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`influencers`::
|
`influencers`::
|
||||||
(+array+) An array of influencer objects.
|
(array) An array of influencer objects.
|
||||||
For more information, see <<ml-results-influencers,Influencers>>.
|
For more information, see <<ml-results-influencers,Influencers>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -17,7 +17,7 @@ The get jobs API allows you to retrieve usage information for jobs.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job. If you do not specify this optional parameter,
|
(string) Identifier for the job. If you do not specify this optional parameter,
|
||||||
the API returns information about all jobs that you have authority to view.
|
the API returns information about all jobs that you have authority to view.
|
||||||
|
|
||||||
|
|
||||||
|
@ -26,7 +26,7 @@ The get jobs API allows you to retrieve usage information for jobs.
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`jobs`::
|
`jobs`::
|
||||||
(+array+) An array of job count objects.
|
(array) An array of job count objects.
|
||||||
For more information, see <<ml-jobcounts,Job Counts>>.
|
For more information, see <<ml-jobcounts,Job Counts>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -17,15 +17,15 @@ The get jobs API enables you to retrieve configuration information for jobs.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job. If you do not specify this optional parameter,
|
(string) Identifier for the job. If you do not specify this optional parameter,
|
||||||
the API returns information about all jobs that you have authority to view.
|
the API returns information about all jobs that you have authority to view.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
he API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`jobs`::
|
`jobs`::
|
||||||
(+array+) An array of job resources.
|
(array) An array of job resources.
|
||||||
For more information, see <<ml-job-resource,Job Resources>>.
|
For more information, see <<ml-job-resource,Job Resources>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -15,49 +15,49 @@ The get records API enables you to retrieve anomaly records for a job.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job.
|
(string) Identifier for the job.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`desc`::
|
`desc`::
|
||||||
(+boolean+) If true, the results are sorted in descending order.
|
(boolean) If true, the results are sorted in descending order.
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+string+) Returns records with timestamps earlier than this time.
|
(string) Returns records with timestamps earlier than this time.
|
||||||
|
|
||||||
`expand`::
|
`expand`::
|
||||||
(+boolean+) TBD
|
(boolean) TBD
|
||||||
//This field did not work on older build.
|
//This field did not work on older build.
|
||||||
|
|
||||||
`from`::
|
`from`::
|
||||||
(+integer+) Skips the specified number of records.
|
(integer) Skips the specified number of records.
|
||||||
|
|
||||||
`include_interim`::
|
`include_interim`::
|
||||||
(+boolean+) If true, the output includes interim results.
|
(boolean) If true, the output includes interim results.
|
||||||
|
|
||||||
`partition_value`::
|
`partition_value`::
|
||||||
(+string+) If `expand` is true, the records are filtered by this
|
(string) If `expand` is true, the records are filtered by this
|
||||||
partition value.
|
partition value.
|
||||||
|
|
||||||
`record_score`::
|
`record_score`::
|
||||||
(+double+) Returns records with anomaly scores higher than this value.
|
(double) Returns records with anomaly scores higher than this value.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(+integer+) Specifies the maximum number of records to obtain.
|
(integer) Specifies the maximum number of records to obtain.
|
||||||
|
|
||||||
`sort`::
|
`sort`::
|
||||||
(+string+) Specifies the sort field for the requested records.
|
(string) Specifies the sort field for the requested records.
|
||||||
By default, the records are sorted by the `anomaly_score` value.
|
By default, the records are sorted by the `anomaly_score` value.
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) Returns records with timestamps after this time.
|
(string) Returns records with timestamps after this time.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`records`::
|
`records`::
|
||||||
(+array+) An array of record objects. For more information, see
|
(array) An array of record objects. For more information, see
|
||||||
<<ml-results-records,Records>>.
|
<<ml-results-records,Records>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -16,44 +16,44 @@ The get model snapshots API enables you to retrieve information about model snap
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) Identifier for the job.
|
(string) Identifier for the job.
|
||||||
|
|
||||||
`snapshot_id`::
|
`snapshot_id`::
|
||||||
(+string+) Identifier for the model snapshot. If you do not specify this optional parameter,
|
(string) Identifier for the model snapshot. If you do not specify this optional parameter,
|
||||||
the API returns information about all model snapshots that you have authority to view.
|
the API returns information about all model snapshots that you have authority to view.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`desc`::
|
`desc`::
|
||||||
(+boolean+) If true, the results are sorted in descending order.
|
(boolean) If true, the results are sorted in descending order.
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) Returns snapshots that match this description.
|
(string) Returns snapshots that match this description.
|
||||||
//TBD: I couldn't get this to work. What description value is it using?
|
//TBD: I couldn't get this to work. What description value is it using?
|
||||||
NOTE: It might be necessary to URL encode the description.
|
NOTE: It might be necessary to URL encode the description.
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+date+) Returns snapshots with timestamps earlier than this time.
|
(date) Returns snapshots with timestamps earlier than this time.
|
||||||
|
|
||||||
`from`::
|
`from`::
|
||||||
(+integer+) Skips the specified number of snapshots.
|
(integer) Skips the specified number of snapshots.
|
||||||
|
|
||||||
`size`::
|
`size`::
|
||||||
(+integer+) Specifies the maximum number of snapshots to obtain.
|
(integer) Specifies the maximum number of snapshots to obtain.
|
||||||
|
|
||||||
`sort`::
|
`sort`::
|
||||||
(+string+) Specifies the sort field for the requested snapshots.
|
(string) Specifies the sort field for the requested snapshots.
|
||||||
//By default, the snapshots are sorted by the xxx value.
|
//By default, the snapshots are sorted by the xxx value.
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) Returns snapshots with timestamps after this time.
|
(string) Returns snapshots with timestamps after this time.
|
||||||
|
|
||||||
===== Results
|
===== Results
|
||||||
|
|
||||||
The API returns the following information:
|
The API returns the following information:
|
||||||
|
|
||||||
`model_snapshots`::
|
`model_snapshots`::
|
||||||
(+array+) An array of model snapshot objects. For more information, see
|
(array) An array of model snapshot objects. For more information, see
|
||||||
<<ml-snapshot-resource,Model Snapshots>>.
|
<<ml-snapshot-resource,Model Snapshots>>.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -9,18 +9,18 @@ NOTE: Job count values are cumulative for the lifetime of a job. If a model snap
|
||||||
or old results are deleted, the job counts are not reset.
|
or old results are deleted, the job counts are not reset.
|
||||||
|
|
||||||
`data_counts`::
|
`data_counts`::
|
||||||
(+object+) An object that describes the number of records processed and any related error counts.
|
(object) An object that describes the number of records processed and any related error counts.
|
||||||
See <<ml-datacounts,data counts objects>>.
|
See <<ml-datacounts,data counts objects>>.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`model_size_stats`::
|
`model_size_stats`::
|
||||||
(+object+) An object that provides information about the size and contents of the model.
|
(object) An object that provides information about the size and contents of the model.
|
||||||
See <<ml-modelsizestats,model size stats objects>>
|
See <<ml-modelsizestats,model size stats objects>>
|
||||||
|
|
||||||
`state`::
|
`state`::
|
||||||
(+string+) The status of the job, which can be one of the following values:
|
(string) The status of the job, which can be one of the following values:
|
||||||
`open`::: The job is actively receiving and processing data.
|
`open`::: The job is actively receiving and processing data.
|
||||||
`closed`::: The job finished successfully with its model state persisted.
|
`closed`::: The job finished successfully with its model state persisted.
|
||||||
The job is still available to accept further data.
|
The job is still available to accept further data.
|
||||||
|
@ -43,59 +43,59 @@ The `data_counts` object describes the number of records processed
|
||||||
and any related error counts. It has the following properties:
|
and any related error counts. It has the following properties:
|
||||||
|
|
||||||
`bucket_count`::
|
`bucket_count`::
|
||||||
(+long+) The number of bucket results produced by the job.
|
(long) The number of bucket results produced by the job.
|
||||||
|
|
||||||
`earliest_record_timestamp`::
|
`earliest_record_timestamp`::
|
||||||
(+string+) The timestamp of the earliest chronologically ordered record.
|
(string) The timestamp of the earliest chronologically ordered record.
|
||||||
The datetime string is in ISO 8601 format.
|
The datetime string is in ISO 8601 format.
|
||||||
|
|
||||||
`empty_bucket_count`::
|
`empty_bucket_count`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
`input_bytes`::
|
`input_bytes`::
|
||||||
(+long+) The number of raw bytes read by the job.
|
(long) The number of raw bytes read by the job.
|
||||||
|
|
||||||
`input_field_count`::
|
`input_field_count`::
|
||||||
(+long+) The total number of record fields read by the job. This count includes
|
(long) The total number of record fields read by the job. This count includes
|
||||||
fields that are not used in the analysis.
|
fields that are not used in the analysis.
|
||||||
|
|
||||||
`input_record_count`::
|
`input_record_count`::
|
||||||
(+long+) The number of data records read by the job.
|
(long) The number of data records read by the job.
|
||||||
|
|
||||||
`invalid_date_count`::
|
`invalid_date_count`::
|
||||||
(+long+) The number of records with either a missing date field or a date that could not be parsed.
|
(long) The number of records with either a missing date field or a date that could not be parsed.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`last_data_time`::
|
`last_data_time`::
|
||||||
(++) TBD
|
() TBD
|
||||||
|
|
||||||
`latest_record_timestamp`::
|
`latest_record_timestamp`::
|
||||||
(+string+) The timestamp of the last chronologically ordered record.
|
(string) The timestamp of the last chronologically ordered record.
|
||||||
If the records are not in strict chronological order, this value might not be
|
If the records are not in strict chronological order, this value might not be
|
||||||
the same as the timestamp of the last record.
|
the same as the timestamp of the last record.
|
||||||
The datetime string is in ISO 8601 format.
|
The datetime string is in ISO 8601 format.
|
||||||
|
|
||||||
`latest_sparse_bucket_timestamp`::
|
`latest_sparse_bucket_timestamp`::
|
||||||
(++) TBD
|
() TBD
|
||||||
|
|
||||||
`missing_field_count`::
|
`missing_field_count`::
|
||||||
(+long+) The number of records that are missing a field that the job is configured to analyze.
|
(long) The number of records that are missing a field that the job is configured to analyze.
|
||||||
Records with missing fields are still processed because it is possible that not all fields are missing.
|
Records with missing fields are still processed because it is possible that not all fields are missing.
|
||||||
The value of `processed_record_count` includes this count.
|
The value of `processed_record_count` includes this count.
|
||||||
|
|
||||||
`out_of_order_timestamp_count`::
|
`out_of_order_timestamp_count`::
|
||||||
(+long+) The number of records that are out of time sequence and outside of the latency window.
|
(long) The number of records that are out of time sequence and outside of the latency window.
|
||||||
These records are discarded, since jobs require time series data to be in ascending chronological order.
|
These records are discarded, since jobs require time series data to be in ascending chronological order.
|
||||||
|
|
||||||
`processed_field_count`::
|
`processed_field_count`::
|
||||||
(+long+) The total number of fields in all the records that have been processed by the job.
|
(long) The total number of fields in all the records that have been processed by the job.
|
||||||
Only fields that are specified in the detector configuration object contribute to this count.
|
Only fields that are specified in the detector configuration object contribute to this count.
|
||||||
The time stamp is not included in this count.
|
The time stamp is not included in this count.
|
||||||
|
|
||||||
`processed_record_count`::
|
`processed_record_count`::
|
||||||
(+long+) The number of records that have been processed by the job.
|
(long) The number of records that have been processed by the job.
|
||||||
This value includes records with missing fields, since they are nonetheless analyzed.
|
This value includes records with missing fields, since they are nonetheless analyzed.
|
||||||
+
|
+
|
||||||
The following records are not processed:
|
The following records are not processed:
|
||||||
|
@ -104,7 +104,7 @@ and any related error counts. It has the following properties:
|
||||||
* Records filtered by an exclude transform
|
* Records filtered by an exclude transform
|
||||||
|
|
||||||
`sparse_bucket_count`::
|
`sparse_bucket_count`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
[[ml-modelsizestats]]
|
[[ml-modelsizestats]]
|
||||||
|
@ -112,41 +112,40 @@ and any related error counts. It has the following properties:
|
||||||
|
|
||||||
The `model_size_stats` object has the following properties:
|
The `model_size_stats` object has the following properties:
|
||||||
|
|
||||||
`job_id`::
|
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
|
||||||
|
|
||||||
`result_type`::
|
|
||||||
TBD
|
|
||||||
|
|
||||||
`model_bytes`::
|
|
||||||
(+long+) The number of bytes of memory used by the models. This is the maximum value since the
|
|
||||||
last time the model was persisted. If the job is closed, this value indicates the latest size.
|
|
||||||
|
|
||||||
`total_by_field_count`::
|
|
||||||
(+long+) The number of `by` field values that were analyzed by the models.
|
|
||||||
|
|
||||||
NOTE: The `by` field values are counted separately for each detector and partition.
|
|
||||||
|
|
||||||
|
|
||||||
`total_over_field_count`::
|
|
||||||
(+long+) The number of `over` field values that were analyzed by the models.
|
|
||||||
|
|
||||||
NOTE: The `over` field values are counted separately for each detector and partition.
|
|
||||||
|
|
||||||
`total_partition_field_count`::
|
|
||||||
(+long+) The number of `partition` field values that were analyzed by the models.
|
|
||||||
|
|
||||||
`bucket_allocation_failures_count`::
|
`bucket_allocation_failures_count`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
|
`job_id`::
|
||||||
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
|
`log_time`::
|
||||||
|
() TBD
|
||||||
|
|
||||||
`memory_status`::
|
`memory_status`::
|
||||||
(+string+) The status of the mathematical models. This property can have one of the following values:
|
(string) The status of the mathematical models. This property can have one of the following values:
|
||||||
`ok`::: The models stayed below the configured value.
|
`ok`::: The models stayed below the configured value.
|
||||||
`soft_limit`::: The models used more than 60% of the configured memory limit and older unused models will be pruned to free up space.
|
`soft_limit`::: The models used more than 60% of the configured memory limit and older unused models will be pruned to free up space.
|
||||||
`hard_limit`::: The models used more space than the configured memory limit. As a result, not all incoming data was processed.
|
`hard_limit`::: The models used more space than the configured memory limit. As a result, not all incoming data was processed.
|
||||||
|
|
||||||
`log_time`::
|
`model_bytes`::
|
||||||
|
(long) The number of bytes of memory used by the models. This is the maximum value since the
|
||||||
|
last time the model was persisted. If the job is closed, this value indicates the latest size.
|
||||||
|
|
||||||
|
`result_type`::
|
||||||
TBD
|
TBD
|
||||||
|
|
||||||
|
`total_by_field_count`::
|
||||||
|
(long) The number of `by` field values that were analyzed by the models.
|
||||||
|
|
||||||
|
NOTE: The `by` field values are counted separately for each detector and partition.
|
||||||
|
|
||||||
|
`total_over_field_count`::
|
||||||
|
(long) The number of `over` field values that were analyzed by the models.
|
||||||
|
|
||||||
|
NOTE: The `over` field values are counted separately for each detector and partition.
|
||||||
|
|
||||||
|
`total_partition_field_count`::
|
||||||
|
(long) The number of `partition` field values that were analyzed by the models.
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
TBD
|
TBD
|
||||||
|
|
|
@ -5,44 +5,44 @@
|
||||||
A job resource has the following properties:
|
A job resource has the following properties:
|
||||||
|
|
||||||
`analysis_config`::
|
`analysis_config`::
|
||||||
(+object+) The analysis configuration, which specifies how to analyze the data. See <<ml-analysisconfig, analysis configuration objects>>.
|
(object) The analysis configuration, which specifies how to analyze the data. See <<ml-analysisconfig, analysis configuration objects>>.
|
||||||
|
|
||||||
`analysis_limits`::
|
`analysis_limits`::
|
||||||
(+object+) Defines limits on the number of field values and time buckets to be analyzed.
|
(object) Defines limits on the number of field values and time buckets to be analyzed.
|
||||||
See <<ml-apilimits,analysis limits>>.
|
See <<ml-apilimits,analysis limits>>.
|
||||||
|
|
||||||
`create_time`::
|
`create_time`::
|
||||||
(+string+) The time the job was created, in ISO 8601 format. For example, `1491007356077`.
|
(string) The time the job was created, in ISO 8601 format. For example, `1491007356077`.
|
||||||
|
|
||||||
`data_description`::
|
`data_description`::
|
||||||
(+object+) Describes the data format and how APIs parse timestamp fields. See <<ml-datadescription,data description objects>>.
|
(object) Describes the data format and how APIs parse timestamp fields. See <<ml-datadescription,data description objects>>.
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) An optional description of the job.
|
(string) An optional description of the job.
|
||||||
|
|
||||||
`finished_time`::
|
`finished_time`::
|
||||||
(+string+) If the job closed of failed, this is the time the job finished, in ISO 8601 format.
|
(string) If the job closed of failed, this is the time the job finished, in ISO 8601 format.
|
||||||
Otherwise, it is `null`. For example, `1491007365347`.
|
Otherwise, it is `null`. For example, `1491007365347`.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`job_type`::
|
`job_type`::
|
||||||
(+string+) TBD. For example: "anomaly_detector".
|
(string) TBD. For example: "anomaly_detector".
|
||||||
|
|
||||||
`model_plot_config`:: TBD
|
`model_plot_config`:: TBD
|
||||||
`enabled`:: TBD. For example, `true`.
|
`enabled`:: TBD. For example, `true`.
|
||||||
|
|
||||||
`model_snapshot_id`::
|
`model_snapshot_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the model
|
(string) A numerical character string that uniquely identifies the model
|
||||||
snapshot. For example, `1491007364`.
|
snapshot. For example, `1491007364`.
|
||||||
|
|
||||||
`model_snapshot_retention_days`::
|
`model_snapshot_retention_days`::
|
||||||
(+long+) The time in days that model snapshots are retained for the job.
|
(long) The time in days that model snapshots are retained for the job.
|
||||||
Older snapshots are deleted. The default value is 1 day.
|
Older snapshots are deleted. The default value is 1 day.
|
||||||
|
|
||||||
`results_index_name`::
|
`results_index_name`::
|
||||||
TBD. For example, `shared`.
|
() TBD. For example, `shared`.
|
||||||
|
|
||||||
[[ml-analysisconfig]]
|
[[ml-analysisconfig]]
|
||||||
===== Analysis Configuration Objects
|
===== Analysis Configuration Objects
|
||||||
|
@ -50,16 +50,16 @@ A job resource has the following properties:
|
||||||
An analysis configuration object has the following properties:
|
An analysis configuration object has the following properties:
|
||||||
|
|
||||||
`bucket_span` (required)::
|
`bucket_span` (required)::
|
||||||
(+unsigned integer+) The size of the interval that the analysis is aggregated into, measured in seconds. The default value is 5 minutes.
|
(unsigned integer) The size of the interval that the analysis is aggregated into, measured in seconds. The default value is 5 minutes.
|
||||||
//TBD: Is this now measured in minutes?
|
//TBD: Is this now measured in minutes?
|
||||||
|
|
||||||
`categorization_field_name`::
|
`categorization_field_name`::
|
||||||
(+string+) If not null, the values of the specified field will be categorized.
|
(string) If not null, the values of the specified field will be categorized.
|
||||||
The resulting categories can be used in a detector by setting `by_field_name`,
|
The resulting categories can be used in a detector by setting `by_field_name`,
|
||||||
`over_field_name`, or `partition_field_name` to the keyword `prelertcategory`.
|
`over_field_name`, or `partition_field_name` to the keyword `prelertcategory`.
|
||||||
|
|
||||||
`categorization_filters`::
|
`categorization_filters`::
|
||||||
(+array of strings+) If `categorization_field_name` is specified, you can also define optional filters.
|
(array of strings) If `categorization_field_name` is specified, you can also define optional filters.
|
||||||
This property expects an array of regular expressions.
|
This property expects an array of regular expressions.
|
||||||
The expressions are used to filter out matching sequences off the categorization field values.
|
The expressions are used to filter out matching sequences off the categorization field values.
|
||||||
This functionality is useful to fine tune categorization by excluding sequences
|
This functionality is useful to fine tune categorization by excluding sequences
|
||||||
|
@ -67,7 +67,7 @@ An analysis configuration object has the following properties:
|
||||||
For example, you can exclude SQL statements that appear in your log files.
|
For example, you can exclude SQL statements that appear in your log files.
|
||||||
|
|
||||||
`detectors` (required)::
|
`detectors` (required)::
|
||||||
(+array+) An array of detector configuration objects,
|
(array) An array of detector configuration objects,
|
||||||
which describe the anomaly detectors that are used in the job.
|
which describe the anomaly detectors that are used in the job.
|
||||||
See <<ml-detectorconfig,detector configuration objects>>.
|
See <<ml-detectorconfig,detector configuration objects>>.
|
||||||
|
|
||||||
|
@ -75,19 +75,19 @@ NOTE: If the `detectors` array does not contain at least one detector, no analys
|
||||||
and an error is returned.
|
and an error is returned.
|
||||||
|
|
||||||
`influencers`::
|
`influencers`::
|
||||||
(+array of strings+) A comma separated list of influencer field names.
|
(array of strings) A comma separated list of influencer field names.
|
||||||
Typically these can be the by, over, or partition fields that are used in the detector configuration.
|
Typically these can be the by, over, or partition fields that are used in the detector configuration.
|
||||||
You might also want to use a field name that is not specifically named in a detector,
|
You might also want to use a field name that is not specifically named in a detector,
|
||||||
but is available as part of the input data. When you use multiple detectors,
|
but is available as part of the input data. When you use multiple detectors,
|
||||||
the use of influencers is recommended as it aggregates results for each influencer entity.
|
the use of influencers is recommended as it aggregates results for each influencer entity.
|
||||||
|
|
||||||
`latency`::
|
`latency`::
|
||||||
(+unsigned integer+) The size of the window, in seconds, in which to expect data that is out of time order. The default value is 0 milliseconds (no latency).
|
(unsigned integer) The size of the window, in seconds, in which to expect data that is out of time order. The default value is 0 milliseconds (no latency).
|
||||||
|
|
||||||
NOTE: Latency is only applicable when you send data by using the <<ml-post-data, Post Data to Jobs>> API.
|
NOTE: Latency is only applicable when you send data by using the <<ml-post-data, Post Data to Jobs>> API.
|
||||||
|
|
||||||
`multivariate_by_fields`::
|
`multivariate_by_fields`::
|
||||||
(+boolean+) If set to `true`, the analysis will automatically find correlations
|
(boolean) If set to `true`, the analysis will automatically find correlations
|
||||||
between metrics for a given `by` field value and report anomalies when those
|
between metrics for a given `by` field value and report anomalies when those
|
||||||
correlations cease to hold. For example, suppose CPU and memory usage on host A
|
correlations cease to hold. For example, suppose CPU and memory usage on host A
|
||||||
is usually highly correlated with the same metrics on host B. Perhaps this
|
is usually highly correlated with the same metrics on host B. Perhaps this
|
||||||
|
@ -99,19 +99,18 @@ NOTE: Latency is only applicable when you send data by using the <<ml-post-data,
|
||||||
NOTE: To use the `multivariate_by_fields` property, you must also specify `by_field_name` in your detector.
|
NOTE: To use the `multivariate_by_fields` property, you must also specify `by_field_name` in your detector.
|
||||||
|
|
||||||
`overlapping_buckets`::
|
`overlapping_buckets`::
|
||||||
(+boolean+) If set to `true`, an additional analysis occurs that runs out of phase by half a bucket length.
|
(boolean) If set to `true`, an additional analysis occurs that runs out of phase by half a bucket length.
|
||||||
This requires more system resources and enhances detection of anomalies that span bucket boundaries.
|
This requires more system resources and enhances detection of anomalies that span bucket boundaries.
|
||||||
|
|
||||||
`summary_count_field_name`::
|
`summary_count_field_name`::
|
||||||
(+string+) If not null, the data fed to the job is expected to be pre-summarized.
|
(string) If not null, the data fed to the job is expected to be pre-summarized.
|
||||||
This property value is the name of the field that contains the count of raw data points that have been summarized.
|
This property value is the name of the field that contains the count of raw data points that have been summarized.
|
||||||
The same `summary_count_field_name` applies to all detectors in the job.
|
The same `summary_count_field_name` applies to all detectors in the job.
|
||||||
|
|
||||||
NOTE: The `summary_count_field_name` property cannot be used with the `metric` function.
|
NOTE: The `summary_count_field_name` property cannot be used with the `metric` function.
|
||||||
|
|
||||||
|
|
||||||
`use_per_partition_normalization`::
|
`use_per_partition_normalization`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
[[ml-detectorconfig]]
|
[[ml-detectorconfig]]
|
||||||
===== Detector Configuration Objects
|
===== Detector Configuration Objects
|
||||||
|
@ -122,31 +121,31 @@ You can specify multiple detectors for a job.
|
||||||
Each detector has the following properties:
|
Each detector has the following properties:
|
||||||
|
|
||||||
`by_field_name`::
|
`by_field_name`::
|
||||||
(+string+) The field used to split the data.
|
(string) The field used to split the data.
|
||||||
In particular, this property is used for analyzing the splits with respect to their own history.
|
In particular, this property is used for analyzing the splits with respect to their own history.
|
||||||
It is used for finding unusual values in the context of the split.
|
It is used for finding unusual values in the context of the split.
|
||||||
|
|
||||||
`detector_description`::
|
`detector_description`::
|
||||||
(+string+) A description of the detector. For example, `low_sum(events_per_min)`.
|
(string) A description of the detector. For example, `low_sum(events_per_min)`.
|
||||||
|
|
||||||
`detector_rules`::
|
`detector_rules`::
|
||||||
(+array+) TBD
|
(array) TBD
|
||||||
|
|
||||||
`exclude_frequent`::
|
`exclude_frequent`::
|
||||||
(+string+) Contains one of the following values: `all`, `none`, `by`, or `over`.
|
(string) Contains one of the following values: `all`, `none`, `by`, or `over`.
|
||||||
If set, frequent entities are excluded from influencing the anomaly results.
|
If set, frequent entities are excluded from influencing the anomaly results.
|
||||||
Entities can be considered frequent over time or frequent in a population.
|
Entities can be considered frequent over time or frequent in a population.
|
||||||
If you are working with both over and by fields, then you can set `exclude_frequent`
|
If you are working with both over and by fields, then you can set `exclude_frequent`
|
||||||
to `all` for both fields, or to `by` or `over` for those specific fields.
|
to `all` for both fields, or to `by` or `over` for those specific fields.
|
||||||
|
|
||||||
`field_name`::
|
`field_name`::
|
||||||
(+string+) The field that the detector uses in the function. If you use an event rate
|
(string) The field that the detector uses in the function. If you use an event rate
|
||||||
function such as `count` or `rare`, do not specify this field.
|
function such as `count` or `rare`, do not specify this field.
|
||||||
|
|
||||||
NOTE: The `field_name` cannot contain double quotes or backslashes.
|
NOTE: The `field_name` cannot contain double quotes or backslashes.
|
||||||
|
|
||||||
`function` (required)::
|
`function` (required)::
|
||||||
(+string+) The analysis function that is used.
|
(string) The analysis function that is used.
|
||||||
For example, `count`, `rare`, `mean`, `min`, `max`, and `sum`.
|
For example, `count`, `rare`, `mean`, `min`, `max`, and `sum`.
|
||||||
The default function is `metric`, which looks for anomalies in all of `min`, `max`,
|
The default function is `metric`, which looks for anomalies in all of `min`, `max`,
|
||||||
and `mean`.
|
and `mean`.
|
||||||
|
@ -155,16 +154,16 @@ NOTE: You cannot use the `metric` function with pre-summarized input. If `summar
|
||||||
is not null, you must specify a function other than `metric`.
|
is not null, you must specify a function other than `metric`.
|
||||||
|
|
||||||
`over_field_name`::
|
`over_field_name`::
|
||||||
(+string+) The field used to split the data.
|
(string) The field used to split the data.
|
||||||
In particular, this property is used for analyzing the splits with respect to the history of all splits.
|
In particular, this property is used for analyzing the splits with respect to the history of all splits.
|
||||||
It is used for finding unusual values in the population of all splits.
|
It is used for finding unusual values in the population of all splits.
|
||||||
|
|
||||||
`partition_field_name`::
|
`partition_field_name`::
|
||||||
(+string+) The field used to segment the analysis.
|
(string) The field used to segment the analysis.
|
||||||
When you use this property, you have completely independent baselines for each value of this field.
|
When you use this property, you have completely independent baselines for each value of this field.
|
||||||
|
|
||||||
`use_null`::
|
`use_null`::
|
||||||
(+boolean+) Defines whether a new series is used as the null series
|
(boolean) Defines whether a new series is used as the null series
|
||||||
when there is no value for the by or partition fields. The default value is `false`
|
when there is no value for the by or partition fields. The default value is `false`
|
||||||
|
|
||||||
IMPORTANT: Field names are case sensitive, for example a field named 'Bytes' is different to one named 'bytes'.
|
IMPORTANT: Field names are case sensitive, for example a field named 'Bytes' is different to one named 'bytes'.
|
||||||
|
@ -189,17 +188,17 @@ format of your data.
|
||||||
A data description object has the following properties:
|
A data description object has the following properties:
|
||||||
|
|
||||||
`fieldDelimiter`::
|
`fieldDelimiter`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
`format`::
|
`format`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
`time_field`::
|
`time_field`::
|
||||||
(+string+) The name of the field that contains the timestamp.
|
(string) The name of the field that contains the timestamp.
|
||||||
The default value is `time`.
|
The default value is `time`.
|
||||||
|
|
||||||
`time_format`::
|
`time_format`::
|
||||||
(+string+) The time format, which can be `epoch`, `epoch_ms`, or a custom pattern.
|
(string) The time format, which can be `epoch`, `epoch_ms`, or a custom pattern.
|
||||||
The default value is `epoch`, which refers to UNIX or Epoch time (the number of seconds
|
The default value is `epoch`, which refers to UNIX or Epoch time (the number of seconds
|
||||||
since 1 Jan 1970) and corresponds to the time_t type in C and C++.
|
since 1 Jan 1970) and corresponds to the time_t type in C and C++.
|
||||||
The value `epoch_ms` indicates that time is measured in milliseconds since the epoch.
|
The value `epoch_ms` indicates that time is measured in milliseconds since the epoch.
|
||||||
|
@ -208,7 +207,7 @@ A data description object has the following properties:
|
||||||
NOTE: Custom patterns must conform to the Java `DateTimeFormatter` class. When you use date-time formatting patterns, it is recommended that you provide the full date, time and time zone. For example: `yyyy-MM-dd'T'HH:mm:ssX`. If the pattern that you specify is not sufficient to produce a complete timestamp, job creation fails.
|
NOTE: Custom patterns must conform to the Java `DateTimeFormatter` class. When you use date-time formatting patterns, it is recommended that you provide the full date, time and time zone. For example: `yyyy-MM-dd'T'HH:mm:ssX`. If the pattern that you specify is not sufficient to produce a complete timestamp, job creation fails.
|
||||||
|
|
||||||
`quotecharacter`::
|
`quotecharacter`::
|
||||||
TBD
|
() TBD
|
||||||
|
|
||||||
[[ml-apilimits]]
|
[[ml-apilimits]]
|
||||||
===== Analysis Limits
|
===== Analysis Limits
|
||||||
|
@ -220,7 +219,7 @@ If necessary, the limits can also be updated after the job is created.
|
||||||
The `analysis_limits` object has the following properties:
|
The `analysis_limits` object has the following properties:
|
||||||
|
|
||||||
`categorization_examples_limit`::
|
`categorization_examples_limit`::
|
||||||
(+long+) The maximum number of examples stored per category in memory and
|
(long) The maximum number of examples stored per category in memory and
|
||||||
in the results data store. The default value is 4. If you increase this value,
|
in the results data store. The default value is 4. If you increase this value,
|
||||||
more examples are available, however it requires that you have more storage available.
|
more examples are available, however it requires that you have more storage available.
|
||||||
If you set this value to `0`, no examples are stored.
|
If you set this value to `0`, no examples are stored.
|
||||||
|
@ -229,6 +228,6 @@ The `analysis_limits` object has the following properties:
|
||||||
NOTE: The `categorization_examples_limit` only applies to analysis that uses categorization.
|
NOTE: The `categorization_examples_limit` only applies to analysis that uses categorization.
|
||||||
////
|
////
|
||||||
`model_memory_limit`::
|
`model_memory_limit`::
|
||||||
(+long+) The maximum amount of memory, in MiB, that the mathematical models can use.
|
(long) The maximum amount of memory, in MiB, that the mathematical models can use.
|
||||||
Once this limit is approached, data pruning becomes more aggressive.
|
Once this limit is approached, data pruning becomes more aggressive.
|
||||||
Upon exceeding this limit, new entities are not modeled. The default value is 4096.
|
Upon exceeding this limit, new entities are not modeled. The default value is 4096.
|
||||||
|
|
|
@ -21,16 +21,16 @@ The job is ready to resume its analysis from where it left off, once new data is
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`open_timeout`::
|
`open_timeout`::
|
||||||
(+time+) Controls the time to wait until a job has opened.
|
(time) Controls the time to wait until a job has opened.
|
||||||
The default value is 30 minutes.
|
The default value is 30 minutes.
|
||||||
|
|
||||||
`ignore_downtime`::
|
`ignore_downtime`::
|
||||||
(+boolean+) If true (default), any gap in data since it was
|
(boolean) If true (default), any gap in data since it was
|
||||||
last closed is treated as a maintenance window. That is to say, it is not an anomaly
|
last closed is treated as a maintenance window. That is to say, it is not an anomaly
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -25,15 +25,15 @@ or a comma separated list.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`reset_start`::
|
`reset_start`::
|
||||||
(+string+) Specifies the start of the bucket resetting range
|
(string) Specifies the start of the bucket resetting range
|
||||||
|
|
||||||
`reset_end`::
|
`reset_end`::
|
||||||
(+string+) Specifies the end of the bucket resetting range"
|
(string) Specifies the end of the bucket resetting range"
|
||||||
|
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
|
@ -17,7 +17,7 @@ The API returns example data by using the current data feed settings.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) Identifier for the data feed
|
(string) Identifier for the data feed
|
||||||
|
|
||||||
////
|
////
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
|
@ -16,28 +16,28 @@ data feed to each job.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) A numerical character string that uniquely identifies the data feed.
|
(string) A numerical character string that uniquely identifies the data feed.
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`aggregations`::
|
`aggregations`::
|
||||||
(+object+) TBD.
|
(object) TBD.
|
||||||
|
|
||||||
`chunking_config`::
|
`chunking_config`::
|
||||||
(+object+) TBD.
|
(object) TBD.
|
||||||
For example: {"mode": "manual", "time_span": "30000000ms"}
|
For example: {"mode": "manual", "time_span": "30000000ms"}
|
||||||
|
|
||||||
`frequency`::
|
`frequency`::
|
||||||
TBD: For example: "150s"
|
TBD: For example: "150s"
|
||||||
|
|
||||||
`indexes` (required)::
|
`indexes` (required)::
|
||||||
(+array+) An array of index names. For example: ["it_ops_metrics"]
|
(array) An array of index names. For example: ["it_ops_metrics"]
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`query`::
|
`query`::
|
||||||
(+object+) The query that retrieves the data.
|
(object) The query that retrieves the data.
|
||||||
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
||||||
|
|
||||||
`query_delay`::
|
`query_delay`::
|
||||||
|
|
|
@ -15,31 +15,31 @@ The create job API enables you to instantiate a job.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`analysis_config`::
|
`analysis_config`::
|
||||||
(+object+) The analysis configuration, which specifies how to analyze the data.
|
(object) The analysis configuration, which specifies how to analyze the data.
|
||||||
See <<ml-analysisconfig, analysis configuration objects>>.
|
See <<ml-analysisconfig, analysis configuration objects>>.
|
||||||
|
|
||||||
`analysis_limits`::
|
`analysis_limits`::
|
||||||
Optionally specifies runtime limits for the job. See <<ml-apilimits,analysis limits>>.
|
Optionally specifies runtime limits for the job. See <<ml-apilimits,analysis limits>>.
|
||||||
|
|
||||||
`data_description`::
|
`data_description`::
|
||||||
(+object+) Describes the format of the input data.
|
(object) Describes the format of the input data.
|
||||||
See <<ml-datadescription,data description objects>>.
|
See <<ml-datadescription,data description objects>>.
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) An optional description of the job.
|
(string) An optional description of the job.
|
||||||
|
|
||||||
`model_snapshot_retention_days`::
|
`model_snapshot_retention_days`::
|
||||||
(+long+) The time in days that model snapshots are retained for the job.
|
(long) The time in days that model snapshots are retained for the job.
|
||||||
Older snapshots are deleted. The default value is 1 day.
|
Older snapshots are deleted. The default value is 1 day.
|
||||||
|
|
||||||
`results_index_name`::
|
`results_index_name`::
|
||||||
(+string+) TBD. For example, `shared`.
|
(string) TBD. For example, `shared`.
|
||||||
|
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
|
@ -33,23 +33,23 @@ the anomaly records into buckets.
|
||||||
A record object has the following properties:
|
A record object has the following properties:
|
||||||
|
|
||||||
`actual`::
|
`actual`::
|
||||||
(+number+) The actual value for the bucket.
|
(number) The actual value for the bucket.
|
||||||
|
|
||||||
`bucket_span`::
|
`bucket_span`::
|
||||||
(+number+) The length of the bucket in seconds.
|
(number) The length of the bucket in seconds.
|
||||||
This value matches the `bucket_span` that is specified in the job.
|
This value matches the `bucket_span` that is specified in the job.
|
||||||
|
|
||||||
//`byFieldName`::
|
//`byFieldName`::
|
||||||
//TBD: This field did not appear in my results, but it might be a valid property.
|
//TBD: This field did not appear in my results, but it might be a valid property.
|
||||||
// (+string+) The name of the analyzed field, if it was specified in the detector.
|
// (string) The name of the analyzed field, if it was specified in the detector.
|
||||||
|
|
||||||
//`byFieldValue`::
|
//`byFieldValue`::
|
||||||
//TBD: This field did not appear in my results, but it might be a valid property.
|
//TBD: This field did not appear in my results, but it might be a valid property.
|
||||||
// (+string+) The value of `by_field_name`, if it was specified in the detecter.
|
// (string) The value of `by_field_name`, if it was specified in the detecter.
|
||||||
|
|
||||||
//`causes`
|
//`causes`
|
||||||
//TBD: This field did not appear in my results, but it might be a valid property.
|
//TBD: This field did not appear in my results, but it might be a valid property.
|
||||||
// (+array+) If an over field was specified in the detector, this property
|
// (array) If an over field was specified in the detector, this property
|
||||||
// contains an array of anomaly records that are the causes for the anomaly
|
// contains an array of anomaly records that are the causes for the anomaly
|
||||||
// that has been identified for the over field.
|
// that has been identified for the over field.
|
||||||
// If no over fields exist. this field will not be present.
|
// If no over fields exist. this field will not be present.
|
||||||
|
@ -62,76 +62,76 @@ A record object has the following properties:
|
||||||
// Probability and scores are not applicable to causes.
|
// Probability and scores are not applicable to causes.
|
||||||
|
|
||||||
`detector_index`::
|
`detector_index`::
|
||||||
(+number+) A unique identifier for the detector.
|
(number) A unique identifier for the detector.
|
||||||
|
|
||||||
`field_name`::
|
`field_name`::
|
||||||
(+string+) Certain functions require a field to operate on.
|
(string) Certain functions require a field to operate on.
|
||||||
For those functions, this is the name of the field to be analyzed.
|
For those functions, this is the name of the field to be analyzed.
|
||||||
|
|
||||||
`function`::
|
`function`::
|
||||||
(+string+) The function in which the anomaly occurs.
|
(string) The function in which the anomaly occurs.
|
||||||
|
|
||||||
`function_description`::
|
`function_description`::
|
||||||
(+string+) The description of the function in which the anomaly occurs, as
|
(string) The description of the function in which the anomaly occurs, as
|
||||||
specified in the detector configuration information.
|
specified in the detector configuration information.
|
||||||
|
|
||||||
`influencers`::
|
`influencers`::
|
||||||
(+array+) If `influencers` was specified in the detector configuration, then
|
(array) If `influencers` was specified in the detector configuration, then
|
||||||
this array contains influencers that contributed to or were to blame for an
|
this array contains influencers that contributed to or were to blame for an
|
||||||
anomaly.
|
anomaly.
|
||||||
|
|
||||||
`initial_record_score`::
|
`initial_record_score`::
|
||||||
(++) TBD. For example, 94.1386.
|
() TBD. For example, 94.1386.
|
||||||
|
|
||||||
`is_interim`::
|
`is_interim`::
|
||||||
(+boolean+) If true, then this anomaly record is an interim result.
|
(boolean) If true, then this anomaly record is an interim result.
|
||||||
In other words, it is calculated based on partial input data
|
In other words, it is calculated based on partial input data
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
//`kpi_indicator`::
|
//`kpi_indicator`::
|
||||||
// (++) TBD. For example, ["online_purchases"]
|
// () TBD. For example, ["online_purchases"]
|
||||||
// I did not receive this in later tests. Is it still valid?
|
// I did not receive this in later tests. Is it still valid?
|
||||||
|
|
||||||
`partition_field_name`::
|
`partition_field_name`::
|
||||||
(+string+) The name of the partition field that was used in the analysis, if
|
(string) The name of the partition field that was used in the analysis, if
|
||||||
such a field was specified in the detector.
|
such a field was specified in the detector.
|
||||||
|
|
||||||
//`overFieldName`::
|
//`overFieldName`::
|
||||||
// TBD: This field did not appear in my results, but it might be a valid property.
|
// TBD: This field did not appear in my results, but it might be a valid property.
|
||||||
// (+string+) The name of the over field, if `over_field_name` was specified
|
// (string) The name of the over field, if `over_field_name` was specified
|
||||||
// in the detector.
|
// in the detector.
|
||||||
|
|
||||||
`partition_field_value`::
|
`partition_field_value`::
|
||||||
(+string+) The value of the partition field that was used in the analysis, if
|
(string) The value of the partition field that was used in the analysis, if
|
||||||
`partition_field_name` was specified in the detector.
|
`partition_field_name` was specified in the detector.
|
||||||
|
|
||||||
`probability`::
|
`probability`::
|
||||||
(+number+) The probability of the individual anomaly occurring.
|
(number) The probability of the individual anomaly occurring.
|
||||||
This value is in the range 0 to 1. For example, 0.0000772031.
|
This value is in the range 0 to 1. For example, 0.0000772031.
|
||||||
//This value is held to a high precision of over 300 decimal places.
|
//This value is held to a high precision of over 300 decimal places.
|
||||||
//In scientific notation, a value of 3.24E-300 is highly unlikely and therefore
|
//In scientific notation, a value of 3.24E-300 is highly unlikely and therefore
|
||||||
//highly anomalous.
|
//highly anomalous.
|
||||||
|
|
||||||
`record_score`::
|
`record_score`::
|
||||||
(+number+) An anomaly score for the bucket time interval.
|
(number) An anomaly score for the bucket time interval.
|
||||||
The score is calculated based on a sophisticated aggregation of the anomalies
|
The score is calculated based on a sophisticated aggregation of the anomalies
|
||||||
in the bucket.
|
in the bucket.
|
||||||
//Use this score for rate-controlled alerting.
|
//Use this score for rate-controlled alerting.
|
||||||
|
|
||||||
`result_type`::
|
`result_type`::
|
||||||
(+string+) TBD. For example, "record".
|
(string) TBD. For example, "record".
|
||||||
|
|
||||||
`sequence_num`::
|
`sequence_num`::
|
||||||
(++) TBD. For example, 1.
|
() TBD. For example, 1.
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+date+) The start time of the bucket that contains the record, specified in
|
(date) The start time of the bucket that contains the record, specified in
|
||||||
ISO 8601 format. For example, 1454020800000.
|
ISO 8601 format. For example, 1454020800000.
|
||||||
|
|
||||||
`typical`::
|
`typical`::
|
||||||
(+number+) The typical value for the bucket, according to analytical modeling.
|
(number) The typical value for the bucket, according to analytical modeling.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
[[ml-results-influencers]]
|
[[ml-results-influencers]]
|
||||||
|
@ -150,99 +150,99 @@ records that contain this influencer.
|
||||||
An influencer object has the following properties:
|
An influencer object has the following properties:
|
||||||
|
|
||||||
`bucket_span`::
|
`bucket_span`::
|
||||||
(++) TBD. For example, 300.
|
() TBD. For example, 300.
|
||||||
|
|
||||||
// Same as for buckets? i.e. (+unsigned integer+) The length of the bucket in seconds.
|
// Same as for buckets? i.e. (unsigned integer) The length of the bucket in seconds.
|
||||||
// This value is equal to the `bucket_span` value in the job configuration.
|
// This value is equal to the `bucket_span` value in the job configuration.
|
||||||
|
|
||||||
`influencer_score`::
|
`influencer_score`::
|
||||||
(+number+) An anomaly score for the influencer in this bucket time interval.
|
(number) An anomaly score for the influencer in this bucket time interval.
|
||||||
The score is calculated based upon a sophisticated aggregation of the anomalies
|
The score is calculated based upon a sophisticated aggregation of the anomalies
|
||||||
in the bucket for this entity. For example: 94.1386.
|
in the bucket for this entity. For example: 94.1386.
|
||||||
|
|
||||||
`initial_influencer_score`::
|
`initial_influencer_score`::
|
||||||
(++) TBD. For example, 83.3831.
|
() TBD. For example, 83.3831.
|
||||||
|
|
||||||
`influencer_field_name`::
|
`influencer_field_name`::
|
||||||
(+string+) The field name of the influencer.
|
(string) The field name of the influencer.
|
||||||
|
|
||||||
`influencer_field_value`::
|
`influencer_field_value`::
|
||||||
(+string+) The entity that influenced, contributed to, or was to blame for the
|
(string) The entity that influenced, contributed to, or was to blame for the
|
||||||
anomaly.
|
anomaly.
|
||||||
|
|
||||||
`is_interim`::
|
`is_interim`::
|
||||||
(+boolean+) If true, then this is an interim result.
|
(boolean) If true, then this is an interim result.
|
||||||
In other words, it is calculated based on partial input data.
|
In other words, it is calculated based on partial input data.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`kpi_indicator`::
|
`kpi_indicator`::
|
||||||
(++) TBD. For example, "online_purchases".
|
() TBD. For example, "online_purchases".
|
||||||
|
|
||||||
`probability`::
|
`probability`::
|
||||||
(+number+) The probability that the influencer has this behavior.
|
(number) The probability that the influencer has this behavior.
|
||||||
This value is in the range 0 to 1. For example, 0.0000109783.
|
This value is in the range 0 to 1. For example, 0.0000109783.
|
||||||
// For example, 0.03 means 3%. This value is held to a high precision of over
|
// For example, 0.03 means 3%. This value is held to a high precision of over
|
||||||
//300 decimal places. In scientific notation, a value of 3.24E-300 is highly
|
//300 decimal places. In scientific notation, a value of 3.24E-300 is highly
|
||||||
//unlikely and therefore highly anomalous.
|
//unlikely and therefore highly anomalous.
|
||||||
|
|
||||||
`result_type`::
|
`result_type`::
|
||||||
(++) TBD. For example, "influencer".
|
() TBD. For example, "influencer".
|
||||||
|
|
||||||
`sequence_num`::
|
`sequence_num`::
|
||||||
(++) TBD. For example, 2.
|
() TBD. For example, 2.
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+date+) Influencers are produced in buckets. This value is the start time
|
(date) Influencers are produced in buckets. This value is the start time
|
||||||
of the bucket, specified in ISO 8601 format. For example, 1454943900000.
|
of the bucket, specified in ISO 8601 format. For example, 1454943900000.
|
||||||
|
|
||||||
An bucket influencer object has the same following properties:
|
An bucket influencer object has the same following properties:
|
||||||
|
|
||||||
`anomaly_score`::
|
`anomaly_score`::
|
||||||
(+number+) TBD
|
(number) TBD
|
||||||
//It is unclear how this differs from the influencer_score.
|
//It is unclear how this differs from the influencer_score.
|
||||||
//An anomaly score for the influencer in this bucket time interval.
|
//An anomaly score for the influencer in this bucket time interval.
|
||||||
//The score is calculated based upon a sophisticated aggregation of the anomalies
|
//The score is calculated based upon a sophisticated aggregation of the anomalies
|
||||||
//in the bucket for this entity. For example: 94.1386.
|
//in the bucket for this entity. For example: 94.1386.
|
||||||
|
|
||||||
`bucket_span`::
|
`bucket_span`::
|
||||||
(++) TBD. For example, 300.
|
() TBD. For example, 300.
|
||||||
////
|
////
|
||||||
// Same as for buckets? i.e. (+unsigned integer+) The length of the bucket in seconds.
|
// Same as for buckets? i.e. (unsigned integer) The length of the bucket in seconds.
|
||||||
// This value is equal to the `bucket_span` value in the job configuration.
|
// This value is equal to the `bucket_span` value in the job configuration.
|
||||||
////
|
////
|
||||||
`initial_anomaly_score`::
|
`initial_anomaly_score`::
|
||||||
(++) TBD. For example, 83.3831.
|
() TBD. For example, 83.3831.
|
||||||
|
|
||||||
`influencer_field_name`::
|
`influencer_field_name`::
|
||||||
(+string+) The field name of the influencer.
|
(string) The field name of the influencer.
|
||||||
|
|
||||||
`is_interim`::
|
`is_interim`::
|
||||||
(+boolean+) If true, then this is an interim result.
|
(boolean) If true, then this is an interim result.
|
||||||
In other words, it is calculated based on partial input data.
|
In other words, it is calculated based on partial input data.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`probability`::
|
`probability`::
|
||||||
(+number+) The probability that the influencer has this behavior.
|
(number) The probability that the influencer has this behavior.
|
||||||
This value is in the range 0 to 1. For example, 0.0000109783.
|
This value is in the range 0 to 1. For example, 0.0000109783.
|
||||||
// For example, 0.03 means 3%. This value is held to a high precision of over
|
// For example, 0.03 means 3%. This value is held to a high precision of over
|
||||||
//300 decimal places. In scientific notation, a value of 3.24E-300 is highly
|
//300 decimal places. In scientific notation, a value of 3.24E-300 is highly
|
||||||
//unlikely and therefore highly anomalous.
|
//unlikely and therefore highly anomalous.
|
||||||
|
|
||||||
`raw_anomaly_score`::
|
`raw_anomaly_score`::
|
||||||
(++) TBD. For example, 2.32119.
|
() TBD. For example, 2.32119.
|
||||||
|
|
||||||
`result_type`::
|
`result_type`::
|
||||||
(++) TBD. For example, "bucket_influencer".
|
() TBD. For example, "bucket_influencer".
|
||||||
|
|
||||||
`sequence_num`::
|
`sequence_num`::
|
||||||
(++) TBD. For example, 2.
|
() TBD. For example, 2.
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+date+) Influencers are produced in buckets. This value is the start time
|
(date) Influencers are produced in buckets. This value is the start time
|
||||||
of the bucket, specified in ISO 8601 format. For example, 1454943900000.
|
of the bucket, specified in ISO 8601 format. For example, 1454943900000.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
|
@ -270,48 +270,48 @@ accessing the records resource directly and filtering upon date range.
|
||||||
A bucket resource has the following properties:
|
A bucket resource has the following properties:
|
||||||
|
|
||||||
`anomaly_score`::
|
`anomaly_score`::
|
||||||
(+number+) The aggregated and normalized anomaly score.
|
(number) The aggregated and normalized anomaly score.
|
||||||
All the anomaly records in the bucket contribute to this score.
|
All the anomaly records in the bucket contribute to this score.
|
||||||
|
|
||||||
`bucket_influencers`::
|
`bucket_influencers`::
|
||||||
(+array+) An array of influencer objects.
|
(array) An array of influencer objects.
|
||||||
For more information, see <<ml-results-influencers,Influencers>>.
|
For more information, see <<ml-results-influencers,Influencers>>.
|
||||||
|
|
||||||
`bucket_span`::
|
`bucket_span`::
|
||||||
(+unsigned integer+) The length of the bucket in seconds. This value is
|
(unsigned integer) The length of the bucket in seconds. This value is
|
||||||
equal to the `bucket_span` value in the job configuration.
|
equal to the `bucket_span` value in the job configuration.
|
||||||
|
|
||||||
`event_count`::
|
`event_count`::
|
||||||
(+unsigned integer+) The number of input data records processed in this bucket.
|
(unsigned integer) The number of input data records processed in this bucket.
|
||||||
|
|
||||||
`initial_anomaly_score`::
|
`initial_anomaly_score`::
|
||||||
(+number+) The value of `anomaly_score` at the time the bucket result was
|
(number) The value of `anomaly_score` at the time the bucket result was
|
||||||
created. This is normalized based on data which has already been seen;
|
created. This is normalized based on data which has already been seen;
|
||||||
this is not re-normalized and therefore is not adjusted for more recent data.
|
this is not re-normalized and therefore is not adjusted for more recent data.
|
||||||
//TBD. This description is unclear.
|
//TBD. This description is unclear.
|
||||||
|
|
||||||
`is_interim`::
|
`is_interim`::
|
||||||
(+boolean+) If true, then this bucket result is an interim result.
|
(boolean) If true, then this bucket result is an interim result.
|
||||||
In other words, it is calculated based on partial input data.
|
In other words, it is calculated based on partial input data.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`partition_scores`::
|
`partition_scores`::
|
||||||
(+TBD+) TBD. For example, [].
|
(TBD) TBD. For example, [].
|
||||||
|
|
||||||
`processing_time_ms`::
|
`processing_time_ms`::
|
||||||
(+unsigned integer+) The time in milliseconds taken to analyze the bucket
|
(unsigned integer) The time in milliseconds taken to analyze the bucket
|
||||||
contents and produce results.
|
contents and produce results.
|
||||||
|
|
||||||
`record_count`::
|
`record_count`::
|
||||||
(+unsigned integer+) The number of anomaly records in this bucket.
|
(unsigned integer) The number of anomaly records in this bucket.
|
||||||
|
|
||||||
`result_type`::
|
`result_type`::
|
||||||
(+string+) TBD. For example, "bucket".
|
(string) TBD. For example, "bucket".
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+date+) The start time of the bucket, specified in ISO 8601 format.
|
(date) The start time of the bucket, specified in ISO 8601 format.
|
||||||
For example, 1454020800000. This timestamp uniquely identifies the bucket.
|
For example, 1454020800000. This timestamp uniquely identifies the bucket.
|
||||||
|
|
||||||
NOTE: Events that occur exactly at the timestamp of the bucket are included in
|
NOTE: Events that occur exactly at the timestamp of the bucket are included in
|
||||||
|
@ -329,24 +329,24 @@ values.
|
||||||
A category resource has the following properties:
|
A category resource has the following properties:
|
||||||
|
|
||||||
`category_id`::
|
`category_id`::
|
||||||
(+unsigned integer+) A unique identifier for the category.
|
(unsigned integer) A unique identifier for the category.
|
||||||
|
|
||||||
`examples`::
|
`examples`::
|
||||||
(+array+) A list of examples of actual values that matched the category.
|
(array) A list of examples of actual values that matched the category.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`max_matching_length`::
|
`max_matching_length`::
|
||||||
(+unsigned integer+) The maximum length of the fields that matched the
|
(unsigned integer) The maximum length of the fields that matched the
|
||||||
category.
|
category.
|
||||||
//TBD: Still true? "The value is increased by 10% to enable matching for
|
//TBD: Still true? "The value is increased by 10% to enable matching for
|
||||||
//similar fields that have not been analyzed"
|
//similar fields that have not been analyzed"
|
||||||
|
|
||||||
`regex`::
|
`regex`::
|
||||||
(+string+) A regular expression that is used to search for values that match
|
(string) A regular expression that is used to search for values that match
|
||||||
the category.
|
the category.
|
||||||
|
|
||||||
`terms`::
|
`terms`::
|
||||||
(+string+) A space separated list of the common tokens that are matched in
|
(string) A space separated list of the common tokens that are matched in
|
||||||
values of the category.
|
values of the category.
|
||||||
|
|
|
@ -53,17 +53,17 @@ ensure that you do not expect data imminently.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
`snapshot_id` (required)::
|
`snapshot_id` (required)::
|
||||||
(+string+) Identifier for the model snapshot
|
(string) Identifier for the model snapshot
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`delete_intervening_results`::
|
`delete_intervening_results`::
|
||||||
(+boolean+) If true, deletes the results in the time period between the
|
(boolean) If true, deletes the results in the time period between the
|
||||||
latest results and the time of the reverted snapshot. It also resets the
|
latest results and the time of the reverted snapshot. It also resets the
|
||||||
model to accept records for this time period.
|
model to accept records for this time period.
|
||||||
|
|
||||||
NOTE: If you choose not to delete intervening results when reverting a snapshot,
|
NOTE: If you choose not to delete intervening results when reverting a snapshot,
|
||||||
the job will not accept input data that is older than the current time.
|
the job will not accept input data that is older than the current time.
|
||||||
|
|
|
@ -20,32 +20,32 @@ When choosing a new value, consider the following:
|
||||||
A model snapshot resource has the following properties:
|
A model snapshot resource has the following properties:
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) An optional description of the job.
|
(string) An optional description of the job.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`latest_record_time_stamp`::
|
`latest_record_time_stamp`::
|
||||||
(++) TBD. For example: 1455232663000.
|
() TBD. For example: 1455232663000.
|
||||||
|
|
||||||
`latest_result_time_stamp`::
|
`latest_result_time_stamp`::
|
||||||
(++) TBD. For example: 1455229800000.
|
() TBD. For example: 1455229800000.
|
||||||
|
|
||||||
`model_size_stats`::
|
`model_size_stats`::
|
||||||
(+object+) TBD. See <<ml-snapshot-stats,Model Size Statistics>>.
|
(object) TBD. See <<ml-snapshot-stats,Model Size Statistics>>.
|
||||||
|
|
||||||
`retain`::
|
`retain`::
|
||||||
(+boolean+) TBD. For example: false.
|
(boolean) TBD. For example: false.
|
||||||
|
|
||||||
`snapshot_id`::
|
`snapshot_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the model
|
(string) A numerical character string that uniquely identifies the model
|
||||||
snapshot. For example: "1491852978".
|
snapshot. For example: "1491852978".
|
||||||
|
|
||||||
`snapshot_doc_count`::
|
`snapshot_doc_count`::
|
||||||
(++) TBD. For example: 1.
|
() TBD. For example: 1.
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(+date+) The creation timestamp for the snapshot, specified in ISO 8601 format.
|
(date) The creation timestamp for the snapshot, specified in ISO 8601 format.
|
||||||
For example: 1491852978000.
|
For example: 1491852978000.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
|
@ -55,31 +55,31 @@ A model snapshot resource has the following properties:
|
||||||
The `model_size_stats` object has the following properties:
|
The `model_size_stats` object has the following properties:
|
||||||
|
|
||||||
`bucket_allocation_failures_count`::
|
`bucket_allocation_failures_count`::
|
||||||
(++) TBD. For example: 0.
|
() TBD. For example: 0.
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`log_time`::
|
`log_time`::
|
||||||
(++) TBD. For example: 1491852978000.
|
() TBD. For example: 1491852978000.
|
||||||
|
|
||||||
`memory_status`::
|
`memory_status`::
|
||||||
(++) TBD. For example: "ok".
|
() TBD. For example: "ok".
|
||||||
|
|
||||||
`model_bytes`::
|
`model_bytes`::
|
||||||
(++) TBD. For example: 100393.
|
() TBD. For example: 100393.
|
||||||
|
|
||||||
`result_type`::
|
`result_type`::
|
||||||
(++) TBD. For example: "model_size_stats".
|
() TBD. For example: "model_size_stats".
|
||||||
|
|
||||||
`timestamp`::
|
`timestamp`::
|
||||||
(++) TBD. For example: 1455229800000.
|
() TBD. For example: 1455229800000.
|
||||||
|
|
||||||
`total_by_field_count`::
|
`total_by_field_count`::
|
||||||
(++) TBD. For example: 13.
|
() TBD. For example: 13.
|
||||||
|
|
||||||
`total_over_field_count`::
|
`total_over_field_count`::
|
||||||
(++) TBD. For example: 0.
|
() TBD. For example: 0.
|
||||||
|
|
||||||
`total_partition_field_count`::
|
`total_partition_field_count`::
|
||||||
(++) TBD. For example: 2.
|
() TBD. For example: 2.
|
||||||
|
|
|
@ -53,20 +53,20 @@ processed record, that value is ignored.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) Identifier for the data feed
|
(string) Identifier for the data feed
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`end`::
|
`end`::
|
||||||
(+string+) The time that the data feed should end. This value is exclusive.
|
(string) The time that the data feed should end. This value is exclusive.
|
||||||
The default value is an empty string.
|
The default value is an empty string.
|
||||||
|
|
||||||
`start`::
|
`start`::
|
||||||
(+string+) The time that the data feed should begin. This value is inclusive.
|
(string) The time that the data feed should begin. This value is inclusive.
|
||||||
The default value is an empty string.
|
The default value is an empty string.
|
||||||
|
|
||||||
`timeout`::
|
`timeout`::
|
||||||
(+time+) Controls the amount of time to wait until a data feed starts.
|
(time) Controls the amount of time to wait until a data feed starts.
|
||||||
The default value is 20 seconds.
|
The default value is 20 seconds.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -16,15 +16,15 @@ A data feed can be opened and closed multiple times throughout its lifecycle.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) Identifier for the data feed
|
(string) Identifier for the data feed
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
`force`::
|
`force`::
|
||||||
(+boolean+) If true, the data feed is stopped forcefully.
|
(boolean) If true, the data feed is stopped forcefully.
|
||||||
|
|
||||||
`timeout`::
|
`timeout`::
|
||||||
(+time+) Controls the amount of time to wait until a data feed stops.
|
(time) Controls the amount of time to wait until a data feed stops.
|
||||||
The default value is 20 seconds.
|
The default value is 20 seconds.
|
||||||
|
|
||||||
////
|
////
|
||||||
|
|
|
@ -15,40 +15,40 @@ The update data feed API enables you to update certain properties of a data feed
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`feed_id` (required)::
|
`feed_id` (required)::
|
||||||
(+string+) Identifier for the data feed
|
(string) Identifier for the data feed
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
The following properties can be updated after the data feed is created:
|
The following properties can be updated after the data feed is created:
|
||||||
|
|
||||||
`aggregations`::
|
`aggregations`::
|
||||||
(+object+) TBD.
|
(object) TBD.
|
||||||
|
|
||||||
`chunking_config`::
|
`chunking_config`::
|
||||||
(+object+) TBD.
|
(object) TBD.
|
||||||
For example: {"mode": "manual", "time_span": "30000000ms"}
|
For example: {"mode": "manual", "time_span": "30000000ms"}
|
||||||
|
|
||||||
`frequency`::
|
`frequency`::
|
||||||
TBD: For example: "150s"
|
() TBD: For example: "150s"
|
||||||
|
|
||||||
`indexes` (required)::
|
`indexes` (required)::
|
||||||
(+array+) An array of index names. For example: ["it_ops_metrics"]
|
(array) An array of index names. For example: ["it_ops_metrics"]
|
||||||
|
|
||||||
`job_id`::
|
`job_id`::
|
||||||
(+string+) A numerical character string that uniquely identifies the job.
|
(string) A numerical character string that uniquely identifies the job.
|
||||||
|
|
||||||
`query`::
|
`query`::
|
||||||
(+object+) The query that retrieves the data.
|
(object) The query that retrieves the data.
|
||||||
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
By default, this property has the following value: `{"match_all": {"boost": 1}}`.
|
||||||
|
|
||||||
`query_delay`::
|
`query_delay`::
|
||||||
TBD. For example: "60s"
|
() TBD. For example: "60s"
|
||||||
|
|
||||||
`scroll_size`::
|
`scroll_size`::
|
||||||
TBD. For example, 1000
|
() TBD. For example, 1000
|
||||||
|
|
||||||
`types` (required)::
|
`types` (required)::
|
||||||
TBD. For example: ["network","sql","kpi"]
|
() TBD. For example: ["network","sql","kpi"]
|
||||||
|
|
||||||
For more information about these properties,
|
For more information about these properties,
|
||||||
see <<ml-datafeed-resource, Data Feed Resources>>.
|
see <<ml-datafeed-resource, Data Feed Resources>>.
|
||||||
|
|
|
@ -17,18 +17,18 @@ data is sent to it.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
The following properties can be updated after the job is created:
|
The following properties can be updated after the job is created:
|
||||||
|
|
||||||
`analysis_config`::
|
`analysis_config`::
|
||||||
(+object+) The analysis configuration, which specifies how to analyze the data.
|
(object) The analysis configuration, which specifies how to analyze the data.
|
||||||
See <<ml-analysisconfig, analysis configuration objects>>. In particular, the following properties can be updated: `categorization_filters`, `detector_description`, TBD.
|
See <<ml-analysisconfig, analysis configuration objects>>. In particular, the following properties can be updated: `categorization_filters`, `detector_description`, TBD.
|
||||||
|
|
||||||
`analysis_limits`::
|
`analysis_limits`::
|
||||||
(+object+) Specifies runtime limits for the job.
|
(object) Specifies runtime limits for the job.
|
||||||
See <<ml-apilimits,analysis limits>>. NOTE:
|
See <<ml-apilimits,analysis limits>>. NOTE:
|
||||||
* You can update the `analysis_limits` only while the job is closed.
|
* You can update the `analysis_limits` only while the job is closed.
|
||||||
* The `model_memory_limit` property value cannot be decreased.
|
* The `model_memory_limit` property value cannot be decreased.
|
||||||
|
@ -36,7 +36,7 @@ The following properties can be updated after the job is created:
|
||||||
increasing the `model_memory_limit` is not recommended.
|
increasing the `model_memory_limit` is not recommended.
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) An optional description of the job.
|
(string) An optional description of the job.
|
||||||
|
|
||||||
////
|
////
|
||||||
This expects data to be sent in JSON format using the POST `_data` API.
|
This expects data to be sent in JSON format using the POST `_data` API.
|
||||||
|
|
|
@ -19,20 +19,20 @@ and new data has been sent to it.
|
||||||
===== Path Parameters
|
===== Path Parameters
|
||||||
|
|
||||||
`job_id` (required)::
|
`job_id` (required)::
|
||||||
(+string+) Identifier for the job
|
(string) Identifier for the job
|
||||||
|
|
||||||
`snapshot_id` (required)::
|
`snapshot_id` (required)::
|
||||||
(+string+) Identifier for the model snapshot
|
(string) Identifier for the model snapshot
|
||||||
|
|
||||||
===== Request Body
|
===== Request Body
|
||||||
|
|
||||||
The following properties can be updated after the model snapshot is created:
|
The following properties can be updated after the model snapshot is created:
|
||||||
|
|
||||||
`description`::
|
`description`::
|
||||||
(+string+) An optional description of the model snapshot.
|
(string) An optional description of the model snapshot.
|
||||||
|
|
||||||
`retain`::
|
`retain`::
|
||||||
(+boolean+) TBD.
|
(boolean) TBD.
|
||||||
|
|
||||||
////
|
////
|
||||||
===== Responses
|
===== Responses
|
||||||
|
|
Loading…
Reference in New Issue