Path parameters

• job_idstring Required

  Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression.

  You can summarize the bucket results for all anomaly detection jobs by using _all or by specifying * as the <job_id>.

Query parameters

• allow_no_matchboolean

  Specifies what to do when the request:

  1. Contains wildcard expressions and there are no jobs that match.
  2. Contains the _all string or no identifiers and there are no matches.
  3. Contains wildcard expressions and there are only partial matches.

  If true, the request returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If this parameter is false, the request returns a 404 status code when there are no matches or only partial matches.

• bucket_spanstring

  The span of the overall buckets. Must be greater or equal to the largest bucket span of the specified anomaly detection jobs, which is the default value.

  By default, an overall bucket has a span equal to the largest bucket span of the specified anomaly detection jobs. To override that behavior, use the optional bucket_span parameter.

  Values are -1 or 0.

• endstring | number

  Returns overall buckets with timestamps earlier than this time.

• exclude_interimboolean

  If true, the output excludes interim results.

• overall_scorenumber | string

  Returns overall buckets with overall scores greater than or equal to this value.

• startstring | number

  Returns overall buckets with timestamps after this time.

• top_nnumber

  The number of top anomaly detection job bucket scores to be used in the overall_score calculation.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • countnumber Required
  • overall_bucketsarray[object] Required

    Array of overall bucket objects

    Hide overall_buckets attributes Show overall_buckets attributes object

    • bucket_spannumber

      Time unit for seconds

    • is_interimboolean Required

      If true, this is an interim result. In other words, the results are calculated based on partial input data.

    • jobsarray[object] Required

      An array of objects that contain the max_anomaly_score per job_id.

      Hide jobs attributes Show jobs attributes object

      • job_idstring Required
      • max_anomaly_scorenumber Required
    • overall_scorenumber Required

      The top_n average of the maximum bucket anomaly_score per job.

    • result_typestring Required

      Internal. This is always set to overall_bucket.

    • timestampnumber

      Time unit for milliseconds

    • timestamp_stringstring | number

      A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

      One of:

      DateTimestringUnitMillisnumber

      Time unit for milliseconds