124 lines
3.1 KiB
Plaintext
124 lines
3.1 KiB
Plaintext
[[ml-get-bucket]]
|
|
==== Get Buckets
|
|
|
|
The get bucket API allows you to retrieve information about buckets in the
|
|
results from a job.
|
|
|
|
===== Request
|
|
|
|
`GET _xpack/ml/anomaly_detectors/<job_id>/results/buckets` +
|
|
|
|
`GET _xpack/ml/anomaly_detectors/<job_id>/results/buckets/<timestamp>`
|
|
|
|
===== Description
|
|
|
|
This API presents a chronological view of the records, grouped by bucket.
|
|
|
|
===== Path Parameters
|
|
|
|
`job_id`::
|
|
(+string+) Identifier for the job
|
|
|
|
`timestamp`::
|
|
(+string+) The timestamp of a single bucket result.
|
|
If you do not specify this optional parameter, the API returns information
|
|
about all buckets that you have authority to view in the job.
|
|
|
|
===== Request Body
|
|
|
|
`anomaly_score`::
|
|
(+double+) Returns buckets with anomaly scores higher than this value.
|
|
|
|
`end`::
|
|
(+string+) Returns buckets with timestamps earlier than this time.
|
|
|
|
`expand`::
|
|
(+boolean+) If true, the output includes anomaly records.
|
|
|
|
`from`::
|
|
(+integer+) Skips the specified number of buckets.
|
|
|
|
`include_interim`::
|
|
(+boolean+) If true, the output includes interim results.
|
|
|
|
`partition_value`::
|
|
(+string+) If `expand` is true, the anomaly records are filtered by this
|
|
partition value.
|
|
|
|
`size`::
|
|
(+integer+) Specifies the maximum number of buckets to obtain.
|
|
|
|
`start`::
|
|
(+string+) Returns buckets with timestamps after this time.
|
|
|
|
===== Results
|
|
|
|
The API returns the following information:
|
|
|
|
`buckets`::
|
|
(+array+) An array of bucket objects. For more information, see
|
|
<<ml-results-buckets,Buckets>>.
|
|
|
|
////
|
|
===== Responses
|
|
|
|
200
|
|
(EmptyResponse) The cluster has been successfully deleted
|
|
404
|
|
(BasicFailedReply) The cluster specified by {cluster_id} cannot be found (code: clusters.cluster_not_found)
|
|
412
|
|
(BasicFailedReply) The Elasticsearch cluster has not been shutdown yet (code: clusters.cluster_plan_state_error)
|
|
////
|
|
===== Examples
|
|
|
|
The following example gets bucket information for the `it-ops-kpi` job:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
GET _xpack/ml/anomaly_detectors/it-ops-kpi/results/buckets
|
|
{
|
|
"anomaly_score": 80,
|
|
"start": "1454530200001"
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
// TEST[skip:todo]
|
|
|
|
In this example, the API returns a single result that matches the specified
|
|
score and time constraints:
|
|
----
|
|
{
|
|
"count": 1,
|
|
"buckets": [
|
|
{
|
|
"job_id": "it-ops-kpi",
|
|
"timestamp": 1454943900000,
|
|
"anomaly_score": 87.2526,
|
|
"bucket_span": 300,
|
|
"initial_anomaly_score": 83.3831,
|
|
"record_count": 1,
|
|
"event_count": 153,
|
|
"is_interim": false,
|
|
"bucket_influencers": [
|
|
{
|
|
"job_id": "it-ops-kpi",
|
|
"result_type": "bucket_influencer",
|
|
"influencer_field_name": "bucket_time",
|
|
"initial_anomaly_score": 83.3831,
|
|
"anomaly_score": 87.2526,
|
|
"raw_anomaly_score": 2.02204,
|
|
"probability": 0.0000109783,
|
|
"timestamp": 1454943900000,
|
|
"bucket_span": 300,
|
|
"sequence_num": 2,
|
|
"is_interim": false
|
|
}
|
|
],
|
|
"processing_time_ms": 3,
|
|
"partition_scores": [],
|
|
"result_type": "bucket"
|
|
}
|
|
]
|
|
}
|
|
----
|