101 lines
3.0 KiB
Plaintext
101 lines
3.0 KiB
Plaintext
[role="xpack"]
|
|
[testenv="platinum"]
|
|
[[ml-get-category]]
|
|
=== Get Categories API
|
|
++++
|
|
<titleabbrev>Get Categories</titleabbrev>
|
|
++++
|
|
|
|
Retrieves job results for one or more categories.
|
|
|
|
|
|
==== Request
|
|
|
|
`GET _xpack/ml/anomaly_detectors/<job_id>/results/categories` +
|
|
|
|
`GET _xpack/ml/anomaly_detectors/<job_id>/results/categories/<category_id>`
|
|
|
|
==== Description
|
|
|
|
For more information about categories, see
|
|
{xpack-ref}/ml-configuring-categories.html[Categorizing Log Messages].
|
|
|
|
==== Path Parameters
|
|
|
|
`job_id`::
|
|
(string) Identifier for the job.
|
|
|
|
`category_id`::
|
|
(long) Identifier for the category. If you do not specify this optional parameter,
|
|
the API returns information about all categories in the job.
|
|
|
|
|
|
==== Request Body
|
|
|
|
`page`::
|
|
`from`:::
|
|
(integer) Skips the specified number of categories.
|
|
`size`:::
|
|
(integer) Specifies the maximum number of categories to obtain.
|
|
|
|
|
|
==== Results
|
|
|
|
The API returns the following information:
|
|
|
|
`categories`::
|
|
(array) An array of category objects. For more information, see
|
|
<<ml-results-categories,Categories>>.
|
|
|
|
|
|
==== Authorization
|
|
|
|
You must have `monitor_ml`, `monitor`, `manage_ml`, or `manage` cluster
|
|
privileges to use this API. You also need `read` index privilege on the index
|
|
that stores the results. The `machine_learning_admin` and `machine_learning_user`
|
|
roles provide these privileges. For more information, see
|
|
{xpack-ref}/security-privileges.html[Security Privileges] and
|
|
{xpack-ref}/built-in-roles.html[Built-in Roles].
|
|
|
|
|
|
==== Examples
|
|
|
|
The following example gets information about one category for the
|
|
`esxi_log` job:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET _xpack/ml/anomaly_detectors/esxi_log/results/categories
|
|
{
|
|
"page":{
|
|
"size": 1
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[skip:todo]
|
|
|
|
In this example, the API returns the following information:
|
|
[source,js]
|
|
----
|
|
{
|
|
"count": 11,
|
|
"categories": [
|
|
{
|
|
"job_id" : "esxi_log",
|
|
"category_id" : 1,
|
|
"terms" : "Vpxa verbose vpxavpxaInvtVm opID VpxaInvtVmChangeListener Guest DiskInfo Changed",
|
|
"regex" : ".*?Vpxa.+?verbose.+?vpxavpxaInvtVm.+?opID.+?VpxaInvtVmChangeListener.+?Guest.+?DiskInfo.+?Changed.*",
|
|
"max_matching_length": 154,
|
|
"examples" : [
|
|
"Oct 19 17:04:44 esxi1.acme.com Vpxa: [3CB3FB90 verbose 'vpxavpxaInvtVm' opID=WFU-33d82c31] [VpxaInvtVmChangeListener] Guest DiskInfo Changed",
|
|
"Oct 19 17:04:45 esxi2.acme.com Vpxa: [3CA66B90 verbose 'vpxavpxaInvtVm' opID=WFU-33927856] [VpxaInvtVmChangeListener] Guest DiskInfo Changed",
|
|
"Oct 19 17:04:51 esxi1.acme.com Vpxa: [FFDBAB90 verbose 'vpxavpxaInvtVm' opID=WFU-25e0d447] [VpxaInvtVmChangeListener] Guest DiskInfo Changed",
|
|
"Oct 19 17:04:58 esxi2.acme.com Vpxa: [FFDDBB90 verbose 'vpxavpxaInvtVm' opID=WFU-bbff0134] [VpxaInvtVmChangeListener] Guest DiskInfo Changed"
|
|
],
|
|
"grok_pattern" : ".*?%{SYSLOGTIMESTAMP:timestamp}.+?Vpxa.+?%{BASE16NUM:field}.+?verbose.+?vpxavpxaInvtVm.+?opID.+?VpxaInvtVmChangeListener.+?Guest.+?DiskInfo.+?Changed.*"
|
|
}
|
|
]
|
|
}
|
|
----
|