88 lines
2.7 KiB
Plaintext
88 lines
2.7 KiB
Plaintext
[role="xpack"]
|
|
[testenv="platinum"]
|
|
[[ml-estimate-model-memory]]
|
|
=== Estimate {anomaly-jobs} model memory API
|
|
++++
|
|
<titleabbrev>Estimate model memory</titleabbrev>
|
|
++++
|
|
|
|
Estimates the model memory an {anomaly-job} is likely to need based on analysis
|
|
configuration details and cardinality estimates for the fields it references.
|
|
|
|
[[ml-estimate-model-memory-request]]
|
|
==== {api-request-title}
|
|
|
|
`POST _ml/anomaly_detectors/_estimate_model_memory`
|
|
|
|
[[ml-estimate-model-memory-prereqs]]
|
|
==== {api-prereq-title}
|
|
|
|
* If the {es} {security-features} are enabled, you must have `manage_ml` or
|
|
`manage` cluster privileges to use this API. See
|
|
<<security-privileges>>.
|
|
|
|
[[ml-estimate-model-memory-request-body]]
|
|
==== {api-request-body-title}
|
|
|
|
`analysis_config`::
|
|
(Required, object) For a list of the properties that you can specify in the
|
|
`analysis_config` component of the body of this API, see <<put-analysisconfig>>.
|
|
|
|
`max_bucket_cardinality`::
|
|
(Optional, object) Estimates of the highest cardinality in a single bucket
|
|
that will be observed for influencer fields over the time period that the job
|
|
analyzes data. To produce a good answer, values must be provided for
|
|
all influencer fields. It does not matter if values are provided for fields
|
|
that are not listed as `influencers`. If there are no `influencers` then
|
|
`max_bucket_cardinality` can be omitted from the request.
|
|
|
|
`overall_cardinality`::
|
|
(Optional, object) Estimates of the cardinality that will be observed for
|
|
fields over the whole time period that the job analyzes data. To produce
|
|
a good answer, values must be provided for fields referenced in the
|
|
`by_field_name`, `over_field_name` and `partition_field_name` of any
|
|
detectors. It does not matter if values are provided for other fields.
|
|
If no detectors have a `by_field_name`, `over_field_name` or
|
|
`partition_field_name` then `overall_cardinality` can be omitted
|
|
from the request.
|
|
|
|
[[ml-estimate-model-memory-example]]
|
|
==== {api-examples-title}
|
|
|
|
[source,console]
|
|
--------------------------------------------------
|
|
POST _ml/anomaly_detectors/_estimate_model_memory
|
|
{
|
|
"analysis_config": {
|
|
"bucket_span": "5m",
|
|
"detectors": [
|
|
{
|
|
"function": "sum",
|
|
"field_name": "bytes",
|
|
"by_field_name": "status",
|
|
"partition_field_name": "app"
|
|
}
|
|
],
|
|
"influencers": [ "source_ip", "dest_ip" ]
|
|
},
|
|
"overall_cardinality": {
|
|
"status": 10,
|
|
"app": 50
|
|
},
|
|
"max_bucket_cardinality": {
|
|
"source_ip": 300,
|
|
"dest_ip": 30
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// TEST[skip:needs-licence]
|
|
|
|
The estimate returns the following result:
|
|
|
|
[source,console-result]
|
|
----
|
|
{
|
|
"model_memory_estimate": "45mb"
|
|
}
|
|
----
|