95 lines
2.7 KiB
Plaintext
95 lines
2.7 KiB
Plaintext
[role="xpack"]
|
|
[testenv="platinum"]
|
|
[[ml-estimate-model-memory]]
|
|
=== Estimate {anomaly-jobs} model memory API
|
|
++++
|
|
<titleabbrev>Estimate model memory</titleabbrev>
|
|
++++
|
|
|
|
Makes an estimation of the memory usage for an {anomaly-job} model. It
|
|
is based on analysis configuration details for the job and cardinality estimates for the
|
|
fields it references.
|
|
|
|
|
|
[[ml-estimate-model-memory-request]]
|
|
==== {api-request-title}
|
|
|
|
`POST _ml/anomaly_detectors/_estimate_model_memory`
|
|
|
|
[[ml-estimate-model-memory-prereqs]]
|
|
==== {api-prereq-title}
|
|
|
|
If the {es} {security-features} are enabled, you must have the following
|
|
equivalent privileges:
|
|
|
|
* `manage_ml` or cluster: `manage`
|
|
|
|
For more information, see <<security-privileges>>.
|
|
|
|
|
|
[[ml-estimate-model-memory-request-body]]
|
|
==== {api-request-body-title}
|
|
|
|
`analysis_config`::
|
|
(Required, object)
|
|
For a list of the properties that you can specify in the `analysis_config`
|
|
component of the body of this API, see <<put-analysisconfig,`analysis_config`>>.
|
|
|
|
`max_bucket_cardinality`::
|
|
(Required^\*^, object)
|
|
Estimates of the highest cardinality in a single bucket that is observed for
|
|
influencer fields over the time period that the job analyzes data. To produce a
|
|
good answer, values must be provided for all influencer fields. Providing values
|
|
for fields that are not listed as `influencers` has no effect on the estimation. +
|
|
^*^It can be omitted from the request if there are no `influencers`.
|
|
|
|
`overall_cardinality`::
|
|
(Required^\*^, object)
|
|
Estimates of the cardinality that is observed for fields over the whole time
|
|
period that the job analyzes data. To produce a good answer, values must be
|
|
provided for fields referenced in the `by_field_name`, `over_field_name` and
|
|
`partition_field_name` of any detectors. Providing values for other fields has
|
|
no effect on the estimation. +
|
|
^*^It can be omitted from the request if no detectors have a `by_field_name`,
|
|
`over_field_name` or `partition_field_name`.
|
|
|
|
[[ml-estimate-model-memory-example]]
|
|
==== {api-examples-title}
|
|
|
|
[source,console]
|
|
--------------------------------------------------
|
|
POST _ml/anomaly_detectors/_estimate_model_memory
|
|
{
|
|
"analysis_config": {
|
|
"bucket_span": "5m",
|
|
"detectors": [
|
|
{
|
|
"function": "sum",
|
|
"field_name": "bytes",
|
|
"by_field_name": "status",
|
|
"partition_field_name": "app"
|
|
}
|
|
],
|
|
"influencers": [ "source_ip", "dest_ip" ]
|
|
},
|
|
"overall_cardinality": {
|
|
"status": 10,
|
|
"app": 50
|
|
},
|
|
"max_bucket_cardinality": {
|
|
"source_ip": 300,
|
|
"dest_ip": 30
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TEST[skip:needs-licence]
|
|
|
|
The estimate returns the following result:
|
|
|
|
[source,console-result]
|
|
----
|
|
{
|
|
"model_memory_estimate": "21mb"
|
|
}
|
|
----
|