OpenSearch/docs/reference/ml/anomaly-detection/apis/estimate-model-memory.asciidoc

88 lines
2.7 KiB
Plaintext

[role="xpack"]
[testenv="platinum"]
[[ml-estimate-model-memory]]
=== Estimate {anomaly-jobs} model memory API
++++
<titleabbrev>Estimate model memory</titleabbrev>
++++
Estimates the model memory an {anomaly-job} is likely to need based on analysis
configuration details and cardinality estimates for the fields it references.
[[ml-estimate-model-memory-request]]
==== {api-request-title}
`POST _ml/anomaly_detectors/_estimate_model_memory`
[[ml-estimate-model-memory-prereqs]]
==== {api-prereq-title}
* If the {es} {security-features} are enabled, you must have `manage_ml` or
`manage` cluster privileges to use this API. See
<<security-privileges>>.
[[ml-estimate-model-memory-request-body]]
==== {api-request-body-title}
`analysis_config`::
(Required, object) For a list of the properties that you can specify in the
`analysis_config` component of the body of this API, see <<put-analysisconfig>>.
`max_bucket_cardinality`::
(Optional, object) Estimates of the highest cardinality in a single bucket
that will be observed for influencer fields over the time period that the job
analyzes data. To produce a good answer, values must be provided for
all influencer fields. It does not matter if values are provided for fields
that are not listed as `influencers`. If there are no `influencers` then
`max_bucket_cardinality` can be omitted from the request.
`overall_cardinality`::
(Optional, object) Estimates of the cardinality that will be observed for
fields over the whole time period that the job analyzes data. To produce
a good answer, values must be provided for fields referenced in the
`by_field_name`, `over_field_name` and `partition_field_name` of any
detectors. It does not matter if values are provided for other fields.
If no detectors have a `by_field_name`, `over_field_name` or
`partition_field_name` then `overall_cardinality` can be omitted
from the request.
[[ml-estimate-model-memory-example]]
==== {api-examples-title}
[source,console]
--------------------------------------------------
POST _ml/anomaly_detectors/_estimate_model_memory
{
"analysis_config": {
"bucket_span": "5m",
"detectors": [
{
"function": "sum",
"field_name": "bytes",
"by_field_name": "status",
"partition_field_name": "app"
}
],
"influencers": [ "source_ip", "dest_ip" ]
},
"overall_cardinality": {
"status": 10,
"app": 50
},
"max_bucket_cardinality": {
"source_ip": 300,
"dest_ip": 30
}
}
--------------------------------------------------
// TEST[skip:needs-licence]
The estimate returns the following result:
[source,console-result]
----
{
"model_memory_estimate": "45mb"
}
----