Create a filter Generally available; Added in 5.4.0

PUT /_ml/filters/{filter_id}
Api key auth Basic auth Bearer auth

A filter contains a list of strings. It can be used by one or more anomaly detection jobs. Specifically, filters are referenced in the custom_rules property of detector configuration objects.

Required authorization

  • Cluster privileges: manage_ml

Path parameters

  • filter_id string Required

    A string that uniquely identifies a filter.

application/json

Body Required

  • description string

    A description of the filter.

  • items array[string]

    The items of the filter. A wildcard * can be used at the beginning or the end of an item. Up to 10000 items are allowed in each filter.

Responses

PUT /_ml/filters/{filter_id} 
PUT _ml/filters/safe_domains
{
  "description": "A list of safe domains",
  "items": ["*.google.com", "wikipedia.org"]
}
resp = client.ml.put_filter(
    filter_id="safe_domains",
    description="A list of safe domains",
    items=[
        "*.google.com",
        "wikipedia.org"
    ],
)
const response = await client.ml.putFilter({
  filter_id: "safe_domains",
  description: "A list of safe domains",
  items: ["*.google.com", "wikipedia.org"],
});
response = client.ml.put_filter(
  filter_id: "safe_domains",
  body: {
    "description": "A list of safe domains",
    "items": [
      "*.google.com",
      "wikipedia.org"
    ]
  }
)
$resp = $client->ml()->putFilter([
    "filter_id" => "safe_domains",
    "body" => [
        "description" => "A list of safe domains",
        "items" => array(
            "*.google.com",
            "wikipedia.org",
        ),
    ],
]);
curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"description":"A list of safe domains","items":["*.google.com","wikipedia.org"]}' "$ELASTICSEARCH_URL/_ml/filters/safe_domains"
Request example
An example body for a `PUT _ml/filters/safe_domains` request. 
{
  "description": "A list of safe domains",
  "items": ["*.google.com", "wikipedia.org"]
}