Path parameters

• name string Required

  the name of the autoscaling policy

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • roles array[string] Required
  • deciders object Required

    Decider settings.

    External documentation
    Hide deciders attribute Show deciders attribute object

    • * object Additional properties

Path parameters

• name string Required

  the name of the autoscaling policy

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

• timeout string

  Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

Path parameters

• name string Required

  the name of the autoscaling policy

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

• timeout string

  Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • policies object Required
    Hide policies attribute Show policies attribute object

    • * object Additional properties
      Hide * attributes Show * attributes object

      • required_capacity object Required
        Hide required_capacity attributes Show required_capacity attributes object

        • node object Required
          Hide node attributes Show node attributes object

          • storage number Required
          • memory number Required
        • total object Required
          Hide total attributes Show total attributes object

          • storage number Required
          • memory number Required
      • current_capacity object Required
        Hide current_capacity attributes Show current_capacity attributes object

        • node object Required
          Hide node attributes Show node attributes object

          • storage number Required
          • memory number Required
        • total object Required
          Hide total attributes Show total attributes object

          • storage number Required
          • memory number Required
      • current_nodes array[object] Required
        Hide current_nodes attribute Show current_nodes attribute object

        • name string Required
      • deciders object Required
        Hide deciders attribute Show deciders attribute object

        • * object Additional properties
          Hide * attributes Show * attributes object

          • required_capacity object Required
            Hide required_capacity attributes Show required_capacity attributes object

            • node object Required
            • total object Required
          • reason_summary string
          • reason_details object

Path parameters

• name string Required

  The name of the analytics collection to be created or updated.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

  • name string Required

Path parameters

• name string Required

  The name of the analytics collection to be deleted

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

Path parameters

• collection_name string Required

  The name of the behavioral analytics collection.

• event_type string

  The analytics event type.

  Values are page_view, search, or search_click.

Query parameters

• debug boolean

  Whether the response type has to include more details

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • accepted boolean Required
  • event object

Path parameters

• name string | array[string]

  A comma-separated list of aliases to retrieve. Supports wildcards (*). To retrieve all aliases, omit this parameter or use * or _all.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• expand_wildcards string | array[string]

  The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden.

  Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.

  Values are all, open, closed, hidden, or none.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  The period to wait for a connection to the master node. If the master node is not available before the timeout expires, the request fails and returns an error. To indicated that the request should never timeout, you can set it to -1.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • alias string

    alias name

  • index string
  • filter string

    filter

  • routing.index string

    index routing

  • routing.search string

    search routing

  • is_write_index string

    write index

Path parameters

• node_id string | array[string]

  A comma-separated list of node identifiers or names used to limit the returned information.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • shards string

    Number of primary and replica shards assigned to the node.

  • shards.undesired string | null

    Amount of shards that are scheduled to be moved elsewhere in the cluster or -1 other than desired balance allocator is used

    One of:

    string-1 string string-2 string | null

  • write_load.forecast number | string | null

    Sum of index write load forecasts

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.indices.forecast number | string | null

    Sum of shard size forecasts

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.indices number | string | null

    Disk space used by the node’s shards. Does not include disk space for the translog or unassigned shards. IMPORTANT: This metric double-counts disk space for hard-linked files, such as those created when shrinking, splitting, or cloning an index.

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.used number | string | null

    Total disk space in use. Elasticsearch retrieves this metric from the node’s operating system (OS). The metric includes disk space for: Elasticsearch, including the translog and unassigned shards; the node’s operating system; any other applications or files on the node. Unlike disk.indices, this metric does not double-count disk space for hard-linked files.

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.avail number | string | null

    Free disk space available to Elasticsearch. Elasticsearch retrieves this metric from the node’s operating system. Disk-based shard allocation uses this metric to assign shards to nodes based on available disk space.

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.total number | string | null

    Total disk space for the node, including in-use and available space.

    One of:

    number-1 number string-2 string string-2 string | null

  • disk.percent string | number | null

    Total percentage of disk space in use. Calculated as disk.used / disk.total.

    One of:

    string-1 string number-2 number string-2 string | null

  • host string | null

    Network host for the node. Set using the network.host setting.

    One of:

    Host string string-2 string | null

  • ip string | null

    IP address and port for the node.

    One of:

    Ip string string-2 string | null
  • node string

    Name for the node. Set using the node.name setting.

  • node.role string | null

    Node roles

    One of:

    string-1 string string-2 string | null

Path parameters

• name string Required

  The name of the component template. It accepts wildcard expressions. If it is omitted, all component templates are returned.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  The period to wait for a connection to the master node.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • name string Required

  • version string | null Required

    One of:

    string-1 string string-2 string | null
  • alias_count string Required
  • mapping_count string Required
  • settings_count string Required
  • metadata_count string Required
  • included_in string Required

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. It supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number string-2 string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • count string

    the document count

Path parameters

• fields string | array[string] Required

  Comma-separated list of fields used to limit returned information. To retrieve all fields, omit this parameter.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• fields string | array[string]

  Comma-separated list of fields used to limit returned information.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

  • field string

    field name

  • size string

    field data usage

Query parameters

• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

• ts boolean

  If true, returns HH:MM:SS and Unix epoch timestamps.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number string-2 string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • cluster string

    cluster name

  • status string

    health status

  • node.total string

    total number of nodes

  • node.data string

    number of nodes that can store data

  • shards string

    total number of shards

  • pri string

    number of primary shards

  • relo string

    number of relocating nodes

  • init string

    number of initializing nodes

  • unassign.pri string

    number of unassigned primary shards

  • unassign string

    number of unassigned shards

  • pending_tasks string

    number of pending tasks

  • max_task_wait_time string

    wait time of longest task pending

  • active_shards_percent string

    active number of shards in percent

Path parameters

• index string | array[string] Required

  Comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• expand_wildcards string | array[string]

  The type of index that wildcard patterns can match.

  Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.

  Values are all, open, closed, hidden, or none.

• health string

  The health status used to limit returned indices. By default, the response includes indices of any health status.

  Supported values include:

  • green (or GREEN): All shards are assigned.
  • yellow (or YELLOW): All primary shards are assigned, but one or more replica shards are unassigned. If a node in the cluster fails, some data could be unavailable until that node is repaired.
  • red (or RED): One or more primary shards are unassigned, so some data is unavailable. This can occur briefly during cluster startup as primary shards are assigned.

  Values are green, GREEN, yellow, YELLOW, red, or RED.

• include_unloaded_segments boolean

  If true, the response includes information from segments that are not loaded into memory.

• pri boolean

  If true, the response only includes information from primary shards.

• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

• master_timeout string

  Period to wait for a connection to the master node.

  Values are -1 or 0.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • health string

    current health status

  • status string

    open/close status

  • index string

    index name

  • uuid string

    index uuid

  • pri string

    number of primary shards

  • rep string

    number of replica shards

  • docs.count string | null

    available docs

    One of:

    string-1 string string-2 string | null

  • docs.deleted string | null

    deleted docs

    One of:

    string-1 string string-2 string | null
  • creation.date string

    index creation date (millisecond value)

  • creation.date.string string

    index creation date (as string)

  • store.size string | null

    store size of primaries & replicas

    One of:

    string-1 string string-2 string | null

  • pri.store.size string | null

    store size of primaries

    One of:

    string-1 string string-2 string | null

  • dataset.size string | null

    total size of dataset (including the cache for partially mounted indices)

    One of:

    string-1 string string-2 string | null
  • completion.size string

    size of completion

  • pri.completion.size string

    size of completion

  • fielddata.memory_size string

    used fielddata cache

  • pri.fielddata.memory_size string

    used fielddata cache

  • fielddata.evictions string

    fielddata evictions

  • pri.fielddata.evictions string

    fielddata evictions

  • query_cache.memory_size string

    used query cache

  • pri.query_cache.memory_size string

    used query cache

  • query_cache.evictions string

    query cache evictions

  • pri.query_cache.evictions string

    query cache evictions

  • request_cache.memory_size string

    used request cache

  • pri.request_cache.memory_size string

    used request cache

  • request_cache.evictions string

    request cache evictions

  • pri.request_cache.evictions string

    request cache evictions

  • request_cache.hit_count string

    request cache hit count

  • pri.request_cache.hit_count string

    request cache hit count

  • request_cache.miss_count string

    request cache miss count

  • pri.request_cache.miss_count string

    request cache miss count

  • flush.total string

    number of flushes

  • pri.flush.total string

    number of flushes

  • flush.total_time string

    time spent in flush

  • pri.flush.total_time string

    time spent in flush

  • get.current string

    number of current get ops

  • pri.get.current string

    number of current get ops

  • get.time string

    time spent in get

  • pri.get.time string

    time spent in get

  • get.total string

    number of get ops

  • pri.get.total string

    number of get ops

  • get.exists_time string

    time spent in successful gets

  • pri.get.exists_time string

    time spent in successful gets

  • get.exists_total string

    number of successful gets

  • pri.get.exists_total string

    number of successful gets

  • get.missing_time string

    time spent in failed gets

  • pri.get.missing_time string

    time spent in failed gets

  • get.missing_total string

    number of failed gets

  • pri.get.missing_total string

    number of failed gets

  • indexing.delete_current string

    number of current deletions

  • pri.indexing.delete_current string

    number of current deletions

  • indexing.delete_time string

    time spent in deletions

  • pri.indexing.delete_time string

    time spent in deletions

  • indexing.delete_total string

    number of delete ops

  • pri.indexing.delete_total string

    number of delete ops

  • indexing.index_current string

    number of current indexing ops

  • pri.indexing.index_current string

    number of current indexing ops

  • indexing.index_time string

    time spent in indexing

  • pri.indexing.index_time string

    time spent in indexing

  • indexing.index_total string

    number of indexing ops

  • pri.indexing.index_total string

    number of indexing ops

  • indexing.index_failed string

    number of failed indexing ops

  • pri.indexing.index_failed string

    number of failed indexing ops

  • merges.current string

    number of current merges

  • pri.merges.current string

    number of current merges

  • merges.current_docs string

    number of current merging docs

  • pri.merges.current_docs string

    number of current merging docs

  • merges.current_size string

    size of current merges

  • pri.merges.current_size string

    size of current merges

  • merges.total string

    number of completed merge ops

  • pri.merges.total string

    number of completed merge ops

  • merges.total_docs string

    docs merged

  • pri.merges.total_docs string

    docs merged

  • merges.total_size string

    size merged

  • pri.merges.total_size string

    size merged

  • merges.total_time string

    time spent in merges

  • pri.merges.total_time string

    time spent in merges

  • refresh.total string

    total refreshes

  • pri.refresh.total string

    total refreshes

  • refresh.time string

    time spent in refreshes

  • pri.refresh.time string

    time spent in refreshes

  • refresh.external_total string

    total external refreshes

  • pri.refresh.external_total string

    total external refreshes

  • refresh.external_time string

    time spent in external refreshes

  • pri.refresh.external_time string

    time spent in external refreshes

  • refresh.listeners string

    number of pending refresh listeners

  • pri.refresh.listeners string

    number of pending refresh listeners

  • search.fetch_current string

    current fetch phase ops

  • pri.search.fetch_current string

    current fetch phase ops

  • search.fetch_time string

    time spent in fetch phase

  • pri.search.fetch_time string

    time spent in fetch phase

  • search.fetch_total string

    total fetch ops

  • pri.search.fetch_total string

    total fetch ops

  • search.open_contexts string

    open search contexts

  • pri.search.open_contexts string

    open search contexts

  • search.query_current string

    current query phase ops

  • pri.search.query_current string

    current query phase ops

  • search.query_time string

    time spent in query phase

  • pri.search.query_time string

    time spent in query phase

  • search.query_total string

    total query phase ops

  • pri.search.query_total string

    total query phase ops

  • search.scroll_current string

    open scroll contexts

  • pri.search.scroll_current string

    open scroll contexts

  • search.scroll_time string

    time scroll contexts held open

  • pri.search.scroll_time string

    time scroll contexts held open

  • search.scroll_total string

    completed scroll contexts

  • pri.search.scroll_total string

    completed scroll contexts

  • segments.count string

    number of segments

  • pri.segments.count string

    number of segments

  • segments.memory string

    memory used by segments

  • pri.segments.memory string

    memory used by segments

  • segments.index_writer_memory string

    memory used by index writer

  • pri.segments.index_writer_memory string

    memory used by index writer

  • segments.version_map_memory string

    memory used by version map

  • pri.segments.version_map_memory string

    memory used by version map

  • segments.fixed_bitset_memory string

    memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields

  • pri.segments.fixed_bitset_memory string

    memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields

  • warmer.current string

    current warmer ops

  • pri.warmer.current string

    current warmer ops

  • warmer.total string

    total warmer ops

  • pri.warmer.total string

    total warmer ops

  • warmer.total_time string

    time spent in warmers

  • pri.warmer.total_time string

    time spent in warmers

  • suggest.current string

    number of current suggest ops

  • pri.suggest.current string

    number of current suggest ops

  • suggest.time string

    time spend in suggest

  • pri.suggest.time string

    time spend in suggest

  • suggest.total string

    number of suggest ops

  • pri.suggest.total string

    number of suggest ops

  • memory.total string

    total used memory

  • pri.memory.total string

    total user memory

  • search.throttled string

    indicates if the index is search throttled

  • bulk.total_operations string

    number of bulk shard ops

  • pri.bulk.total_operations string

    number of bulk shard ops

  • bulk.total_time string

    time spend in shard bulk

  • pri.bulk.total_time string

    time spend in shard bulk

  • bulk.total_size_in_bytes string

    total size in bytes of shard bulk

  • pri.bulk.total_size_in_bytes string

    total size in bytes of shard bulk

  • bulk.avg_time string

    average time spend in shard bulk

  • pri.bulk.avg_time string

    average time spend in shard bulk

  • bulk.avg_size_in_bytes string

    average size in bytes of shard bulk

  • pri.bulk.avg_size_in_bytes string

    average size in bytes of shard bulk

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

Path parameters

• id string Required

  The ID of the data frame analytics to fetch

Query parameters

• allow_no_match boolean

  Whether to ignore if a wildcard expression matches no configs. (This includes _all string or when no configs have been specified)

• bytes string

  The unit in which to display byte values

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): Contains messages relating to the selection of a node.
  • create_time (or ct, createTime): The time when the data frame analytics job was created.
  • description (or d): A description of a job.
  • dest_index (or di, destIndex): Name of the destination index.
  • failure_reason (or fr, failureReason): Contains messages about the reason why a data frame analytics job failed.
  • id: Identifier for the data frame analytics job.
  • model_memory_limit (or mml, modelMemoryLimit): The approximate maximum amount of memory resources that are permitted for the data frame analytics job.
  • node.address (or na, nodeAddress): The network address of the node that the data frame analytics job is assigned to.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that the data frame analytics job is assigned to.
  • node.id (or ni, nodeId): The unique identifier of the node that the data frame analytics job is assigned to.
  • node.name (or nn, nodeName): The name of the node that the data frame analytics job is assigned to.
  • progress (or p): The progress report of the data frame analytics job by phase.
  • source_index (or si, sourceIndex): Name of the source index.
  • state (or s): Current state of the data frame analytics job.
  • type (or t): The type of analysis that the data frame analytics job performs.
  • version (or v): The Elasticsearch version number in which the data frame analytics job was created.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): Contains messages relating to the selection of a node.
  • create_time (or ct, createTime): The time when the data frame analytics job was created.
  • description (or d): A description of a job.
  • dest_index (or di, destIndex): Name of the destination index.
  • failure_reason (or fr, failureReason): Contains messages about the reason why a data frame analytics job failed.
  • id: Identifier for the data frame analytics job.
  • model_memory_limit (or mml, modelMemoryLimit): The approximate maximum amount of memory resources that are permitted for the data frame analytics job.
  • node.address (or na, nodeAddress): The network address of the node that the data frame analytics job is assigned to.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that the data frame analytics job is assigned to.
  • node.id (or ni, nodeId): The unique identifier of the node that the data frame analytics job is assigned to.
  • node.name (or nn, nodeName): The name of the node that the data frame analytics job is assigned to.
  • progress (or p): The progress report of the data frame analytics job by phase.
  • source_index (or si, sourceIndex): Name of the source index.
  • state (or s): Current state of the data frame analytics job.
  • type (or t): The type of analysis that the data frame analytics job performs.
  • version (or v): The Elasticsearch version number in which the data frame analytics job was created.
• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • type string

    The type of analysis that the job performs.

  • create_time string

    The time when the job was created.

  • version string
  • source_index string
  • dest_index string
  • description string

    A description of the job.

  • model_memory_limit string

    The approximate maximum amount of memory resources that are permitted for the job.

  • state string

    The current status of the job.

  • failure_reason string

    Messages about the reason why the job failed.

  • progress string

    The progress report for the job by phase.

  • assignment_explanation string

    Messages related to the selection of a node.

  • node.id string
  • node.name string
  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

Path parameters

• datafeed_id string Required

  A numerical character string that uniquely identifies the datafeed.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no datafeeds that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    The datafeed identifier.

  • state string

    Values are started, stopped, starting, or stopping.

  • assignment_explanation string

    For started datafeeds only, contains messages relating to the selection of a node.

  • buckets.count string

    The number of buckets processed.

  • search.count string

    The number of searches run by the datafeed.

  • search.time string

    The total time the datafeed spent searching, in milliseconds.

  • search.bucket_avg string

    The average search time per bucket, in milliseconds.

  • search.exp_avg_hour string

    The exponential average search time per hour, in milliseconds.

  • node.id string

    The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.name string

    The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.ephemeral_id string

    The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.address string

    The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

Path parameters

• job_id string Required

  Identifier for the anomaly detection job.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no jobs that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • state string

    Values are closing, closed, opened, failed, or opening.

  • opened_time string

    For open jobs only, the amount of time the job has been opened.

  • assignment_explanation string

    For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

  • data.processed_records string

    The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed_record_count is the number of aggregation results processed, not the number of Elasticsearch documents.

  • data.processed_fields string

    The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.

  • data.input_bytes number | string

    One of:

    number-1 number string-2 string
  • data.input_records string

    The number of input documents posted to the anomaly detection job.

  • data.input_fields string

    The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.

  • data.invalid_dates string

    The number of input documents with either a missing date field or a date that could not be parsed.

  • data.missing_fields string

    The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing. If you are using datafeeds or posting data to the job in JSON format, a high missing_field_count is often not an indication of data issues. It is not necessarily a cause for concern.

  • data.out_of_order_timestamps string

    The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.

  • data.empty_buckets string

    The number of buckets which did not contain any data. If your data contains many empty buckets, consider increasing your bucket_span or using functions that are tolerant to gaps in data such as mean, non_null_sum or non_zero_count.

  • data.sparse_buckets string

    The number of buckets that contained few data points compared to the expected number of data points. If your data contains many sparse buckets, consider using a longer bucket_span.

  • data.buckets string

    The total number of buckets processed.

  • data.earliest_record string

    The timestamp of the earliest chronologically input document.

  • data.latest_record string

    The timestamp of the latest chronologically input document.

  • data.last string

    The timestamp at which data was last analyzed, according to server time.

  • data.last_empty_bucket string

    The timestamp of the last bucket that did not contain any data.

  • data.last_sparse_bucket string

    The timestamp of the last bucket that was considered sparse.

  • model.bytes number | string

    One of:

    number-1 number string-2 string
  • model.memory_status string

    Values are ok, soft_limit, or hard_limit.

  • model.bytes_exceeded number | string

    One of:

    number-1 number string-2 string
  • model.memory_limit string

    The upper limit for model memory usage, checked on increasing values.

  • model.by_fields string

    The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.over_fields string

    The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.partition_fields string

    The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.bucket_allocation_failures string

    The number of buckets for which new entities in incoming data were not processed due to insufficient model memory. This situation is also signified by a hard_limit: memory_status property value.

  • model.categorization_status string

    Values are ok or warn.

  • model.categorized_doc_count string

    The number of documents that have had a field categorized.

  • model.total_category_count string

    The number of categories created by categorization.

  • model.frequent_category_count string

    The number of categories that match more than 1% of categorized documents.

  • model.rare_category_count string

    The number of categories that match just one categorized document.

  • model.dead_category_count string

    The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.

  • model.failed_category_count string

    The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model_memory_limit. This count does not track which specific categories failed to be created. Therefore you cannot use this value to determine the number of unique categories that were missed.

  • model.log_time string

    The timestamp when the model stats were gathered, according to server time.

  • model.timestamp string

    The timestamp of the last record when the model stats were gathered.

  • forecasts.total string

    The number of individual forecasts currently available for the job. A value of one or more indicates that forecasts exist.

  • forecasts.memory.min string

    The minimum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.max string

    The maximum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.avg string

    The average memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.total string

    The total memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.records.min string

    The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.max string

    The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.avg string

    The average number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.total string

    The total number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.time.min string

    The minimum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.max string

    The maximum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.avg string

    The average runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.total string

    The total runtime in milliseconds for forecasts related to the anomaly detection job.

  • node.id string
  • node.name string

    The name of the assigned node.

  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

  • buckets.count string

    The number of bucket results produced by the job.

  • buckets.time.total string

    The sum of all bucket processing times, in milliseconds.

  • buckets.time.min string

    The minimum of all bucket processing times, in milliseconds.

  • buckets.time.max string

    The maximum of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg string

    The exponential moving average of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg_hour string

    The exponential moving average of bucket processing times calculated in a one hour time window, in milliseconds.