Path parameters

• name string Required

  the name of the autoscaling policy

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • roles array[string] Required
  • deciders object Required

    Decider settings.

    External documentation
    Hide deciders attribute Show deciders attribute object

    • * object Additional properties

Path parameters

• name string Required

  the name of the autoscaling policy

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

• timeout string

  Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

Query parameters

• master_timeout string

  Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • policies object Required
    Hide policies attribute Show policies attribute object

    • * object Additional properties
      Hide * attributes Show * attributes object

      • required_capacity object Required
        Hide required_capacity attributes Show required_capacity attributes object

        • node object Required
          Hide node attributes Show node attributes object

          • storage number Required
          • memory number Required
        • total object Required
          Hide total attributes Show total attributes object

          • storage number Required
          • memory number Required
      • current_capacity object Required
        Hide current_capacity attributes Show current_capacity attributes object

        • node object Required
          Hide node attributes Show node attributes object

          • storage number Required
          • memory number Required
        • total object Required
          Hide total attributes Show total attributes object

          • storage number Required
          • memory number Required
      • current_nodes array[object] Required
        Hide current_nodes attribute Show current_nodes attribute object

        • name string Required
      • deciders object Required
        Hide deciders attribute Show deciders attribute object

        • * object Additional properties
          Hide * attributes Show * attributes object

          • required_capacity object Required
            Hide required_capacity attributes Show required_capacity attributes object

            • node object Required
            • total object Required
          • reason_summary string
          • reason_details object

Path parameters

• name array[string] Required

  A list of analytics collections to limit the returned information

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • * object Additional properties
    Hide * attribute Show * attribute object

    • event_data_stream object Required
      Hide event_data_stream attribute Show event_data_stream attribute object

      • name string Required

Path parameters

• name string Required

  The name of the analytics collection to be created or updated.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • acknowledged boolean Required

    For a successful response, this value is always true. On failure, an exception is returned instead.

  • name string Required

Path parameters

• collection_name string Required

  The name of the behavioral analytics collection.

• event_type string Required

  The analytics event type.

  Values are page_view, search, or search_click.

Query parameters

• debug boolean

  Whether the response type has to include more details

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • accepted boolean Required
  • event object

Path parameters

• node_id string | array[string] Required

  A comma-separated list of node identifiers or names used to limit the returned information.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • shards string

    Number of primary and replica shards assigned to the node.

  • shards.undesired string | null

    Amount of shards that are scheduled to be moved elsewhere in the cluster or -1 other than desired balance allocator is used

    One of:

    string-1 string string-2 string | null

  • write_load.forecast number | string | null

    Sum of index write load forecasts

    One of:

    Stringifieddouble number Stringifieddouble string string-2 string | null

  • disk.indices.forecast number | string | null

    Sum of shard size forecasts

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.indices number | string | null

    Disk space used by the node’s shards. Does not include disk space for the translog or unassigned shards. IMPORTANT: This metric double-counts disk space for hard-linked files, such as those created when shrinking, splitting, or cloning an index.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.used number | string | null

    Total disk space in use. Elasticsearch retrieves this metric from the node’s operating system (OS). The metric includes disk space for: Elasticsearch, including the translog and unassigned shards; the node’s operating system; any other applications or files on the node. Unlike disk.indices, this metric does not double-count disk space for hard-linked files.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.avail number | string | null

    Free disk space available to Elasticsearch. Elasticsearch retrieves this metric from the node’s operating system. Disk-based shard allocation uses this metric to assign shards to nodes based on available disk space.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.total number | string | null

    Total disk space for the node, including in-use and available space.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.percent string | number | null

    Total percentage of disk space in use. Calculated as disk.used / disk.total.

    One of:

    Percentage string Percentage number string-2 string | null

  • host string | null

    Network host for the node. Set using the network.host setting.

    One of:

    Host string string-2 string | null

  • ip string | null

    IP address and port for the node.

    One of:

    Ip string string-2 string | null
  • node string

    Name for the node. Set using the node.name setting.

  • node.role string | null

    Node roles

    One of:

    string-1 string string-2 string | null

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number StringifiedEpochTimeUnitSeconds string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • count string

    the document count

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. It supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number StringifiedEpochTimeUnitSeconds string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • count string

    the document count

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• fields string | array[string]

  Comma-separated list of fields used to limit returned information.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

  • field string

    field name

  • size string

    field data usage

Path parameters

• fields string | array[string] Required

  Comma-separated list of fields used to limit returned information. To retrieve all fields, omit this parameter.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• fields string | array[string]

  Comma-separated list of fields used to limit returned information.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

  • field string

    field name

  • size string

    field data usage

Query parameters

• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

• ts boolean

  If true, returns HH:MM:SS and Unix epoch timestamps.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number StringifiedEpochTimeUnitSeconds string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • cluster string

    cluster name

  • status string

    health status

  • node.total string

    total number of nodes

  • node.data string

    number of nodes that can store data

  • shards string

    total number of shards

  • pri string

    number of primary shards

  • relo string

    number of relocating nodes

  • init string

    number of initializing nodes

  • unassign.pri string

    number of unassigned primary shards

  • unassign string

    number of unassigned shards

  • pending_tasks string

    number of pending tasks

  • max_task_wait_time string

    wait time of longest task pending

  • active_shards_percent string

    active number of shards in percent

Responses

• 200 application/json

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no datafeeds that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    The datafeed identifier.

  • state string

    Values are started, stopped, starting, or stopping.

  • assignment_explanation string

    For started datafeeds only, contains messages relating to the selection of a node.

  • buckets.count string

    The number of buckets processed.

  • search.count string

    The number of searches run by the datafeed.

  • search.time string

    The total time the datafeed spent searching, in milliseconds.

  • search.bucket_avg string

    The average search time per bucket, in milliseconds.

  • search.exp_avg_hour string

    The exponential average search time per hour, in milliseconds.

  • node.id string

    The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.name string

    The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.ephemeral_id string

    The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.address string

    The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

Path parameters

• datafeed_id string Required

  A numerical character string that uniquely identifies the datafeed.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no datafeeds that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    The datafeed identifier.

  • state string

    Values are started, stopped, starting, or stopping.

  • assignment_explanation string

    For started datafeeds only, contains messages relating to the selection of a node.

  • buckets.count string

    The number of buckets processed.

  • search.count string

    The number of searches run by the datafeed.

  • search.time string

    The total time the datafeed spent searching, in milliseconds.

  • search.bucket_avg string

    The average search time per bucket, in milliseconds.

  • search.exp_avg_hour string

    The exponential average search time per hour, in milliseconds.

  • node.id string

    The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.name string

    The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.ephemeral_id string

    The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.address string

    The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no jobs that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • state string

    Values are closing, closed, opened, failed, or opening.

  • opened_time string

    For open jobs only, the amount of time the job has been opened.

  • assignment_explanation string

    For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

  • data.processed_records string

    The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed_record_count is the number of aggregation results processed, not the number of Elasticsearch documents.

  • data.processed_fields string

    The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.

  • data.input_bytes number | string

    One of:

    ByteSize number ByteSize string
  • data.input_records string

    The number of input documents posted to the anomaly detection job.

  • data.input_fields string

    The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.

  • data.invalid_dates string

    The number of input documents with either a missing date field or a date that could not be parsed.

  • data.missing_fields string

    The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing. If you are using datafeeds or posting data to the job in JSON format, a high missing_field_count is often not an indication of data issues. It is not necessarily a cause for concern.

  • data.out_of_order_timestamps string

    The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.

  • data.empty_buckets string

    The number of buckets which did not contain any data. If your data contains many empty buckets, consider increasing your bucket_span or using functions that are tolerant to gaps in data such as mean, non_null_sum or non_zero_count.

  • data.sparse_buckets string

    The number of buckets that contained few data points compared to the expected number of data points. If your data contains many sparse buckets, consider using a longer bucket_span.

  • data.buckets string

    The total number of buckets processed.

  • data.earliest_record string

    The timestamp of the earliest chronologically input document.

  • data.latest_record string

    The timestamp of the latest chronologically input document.

  • data.last string

    The timestamp at which data was last analyzed, according to server time.

  • data.last_empty_bucket string

    The timestamp of the last bucket that did not contain any data.

  • data.last_sparse_bucket string

    The timestamp of the last bucket that was considered sparse.

  • model.bytes number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_status string

    Values are ok, soft_limit, or hard_limit.

  • model.bytes_exceeded number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_limit string

    The upper limit for model memory usage, checked on increasing values.

  • model.by_fields string

    The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.over_fields string

    The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.partition_fields string

    The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.bucket_allocation_failures string

    The number of buckets for which new entities in incoming data were not processed due to insufficient model memory. This situation is also signified by a hard_limit: memory_status property value.

  • model.categorization_status string

    Values are ok or warn.

  • model.categorized_doc_count string

    The number of documents that have had a field categorized.

  • model.total_category_count string

    The number of categories created by categorization.

  • model.frequent_category_count string

    The number of categories that match more than 1% of categorized documents.

  • model.rare_category_count string

    The number of categories that match just one categorized document.

  • model.dead_category_count string

    The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.

  • model.failed_category_count string

    The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model_memory_limit. This count does not track which specific categories failed to be created. Therefore you cannot use this value to determine the number of unique categories that were missed.

  • model.log_time string

    The timestamp when the model stats were gathered, according to server time.

  • model.timestamp string

    The timestamp of the last record when the model stats were gathered.

  • forecasts.total string

    The number of individual forecasts currently available for the job. A value of one or more indicates that forecasts exist.

  • forecasts.memory.min string

    The minimum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.max string

    The maximum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.avg string

    The average memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.total string

    The total memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.records.min string

    The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.max string

    The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.avg string

    The average number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.total string

    The total number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.time.min string

    The minimum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.max string

    The maximum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.avg string

    The average runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.total string

    The total runtime in milliseconds for forecasts related to the anomaly detection job.

  • node.id string
  • node.name string

    The name of the assigned node.

  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

  • buckets.count string

    The number of bucket results produced by the job.

  • buckets.time.total string

    The sum of all bucket processing times, in milliseconds.

  • buckets.time.min string

    The minimum of all bucket processing times, in milliseconds.

  • buckets.time.max string

    The maximum of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg string

    The exponential moving average of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg_hour string

    The exponential moving average of bucket processing times calculated in a one hour time window, in milliseconds.

Path parameters

• job_id string Required

  Identifier for the anomaly detection job.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no jobs that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • state string

    Values are closing, closed, opened, failed, or opening.

  • opened_time string

    For open jobs only, the amount of time the job has been opened.

  • assignment_explanation string

    For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

  • data.processed_records string

    The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed_record_count is the number of aggregation results processed, not the number of Elasticsearch documents.

  • data.processed_fields string

    The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.

  • data.input_bytes number | string

    One of:

    ByteSize number ByteSize string
  • data.input_records string

    The number of input documents posted to the anomaly detection job.

  • data.input_fields string

    The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.

  • data.invalid_dates string

    The number of input documents with either a missing date field or a date that could not be parsed.

  • data.missing_fields string

    The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing. If you are using datafeeds or posting data to the job in JSON format, a high missing_field_count is often not an indication of data issues. It is not necessarily a cause for concern.

  • data.out_of_order_timestamps string

    The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.

  • data.empty_buckets string

    The number of buckets which did not contain any data. If your data contains many empty buckets, consider increasing your bucket_span or using functions that are tolerant to gaps in data such as mean, non_null_sum or non_zero_count.

  • data.sparse_buckets string

    The number of buckets that contained few data points compared to the expected number of data points. If your data contains many sparse buckets, consider using a longer bucket_span.

  • data.buckets string

    The total number of buckets processed.

  • data.earliest_record string

    The timestamp of the earliest chronologically input document.

  • data.latest_record string

    The timestamp of the latest chronologically input document.

  • data.last string

    The timestamp at which data was last analyzed, according to server time.

  • data.last_empty_bucket string

    The timestamp of the last bucket that did not contain any data.

  • data.last_sparse_bucket string

    The timestamp of the last bucket that was considered sparse.

  • model.bytes number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_status string

    Values are ok, soft_limit, or hard_limit.

  • model.bytes_exceeded number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_limit string

    The upper limit for model memory usage, checked on increasing values.

  • model.by_fields string

    The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.over_fields string

    The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.partition_fields string

    The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.bucket_allocation_failures string

    The number of buckets for which new entities in incoming data were not processed due to insufficient model memory. This situation is also signified by a hard_limit: memory_status property value.

  • model.categorization_status string

    Values are ok or warn.

  • model.categorized_doc_count string

    The number of documents that have had a field categorized.

  • model.total_category_count string

    The number of categories created by categorization.

  • model.frequent_category_count string

    The number of categories that match more than 1% of categorized documents.

  • model.rare_category_count string

    The number of categories that match just one categorized document.

  • model.dead_category_count string

    The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.

  • model.failed_category_count string

    The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model_memory_limit. This count does not track which specific categories failed to be created. Therefore you cannot use this value to determine the number of unique categories that were missed.

  • model.log_time string

    The timestamp when the model stats were gathered, according to server time.

  • model.timestamp string

    The timestamp of the last record when the model stats were gathered.

  • forecasts.total string

    The number of individual forecasts currently available for the job. A value of one or more indicates that forecasts exist.

  • forecasts.memory.min string

    The minimum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.max string

    The maximum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.avg string

    The average memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.total string

    The total memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.records.min string

    The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.max string

    The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.avg string

    The average number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.total string

    The total number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.time.min string

    The minimum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.max string

    The maximum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.avg string

    The average runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.total string

    The total runtime in milliseconds for forecasts related to the anomaly detection job.

  • node.id string
  • node.name string

    The name of the assigned node.

  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

  • buckets.count string

    The number of bucket results produced by the job.

  • buckets.time.total string

    The sum of all bucket processing times, in milliseconds.

  • buckets.time.min string

    The minimum of all bucket processing times, in milliseconds.

  • buckets.time.max string

    The maximum of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg string

    The exponential moving average of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg_hour string

    The exponential moving average of bucket processing times calculated in a one hour time window, in milliseconds.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request: contains wildcard expressions and there are no models that match; contains the _all string or no identifiers and there are no matches; contains wildcard expressions and there are only partial matches. If true, the API returns an empty array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  A comma-separated list of column names to display.

  Supported values include:

  • create_time (or ct): The time when the trained model was created.
  • created_by (or c, createdBy): Information on the creator of the trained model.
  • data_frame_analytics_id (or df, dataFrameAnalytics, dfid): Identifier for the data frame analytics job that created the model. Only displayed if it is still available.
  • description (or d): The description of the trained model.
  • heap_size (or hs, modelHeapSize): The estimated heap size to keep the trained model in memory.
  • id: Identifier for the trained model.
  • ingest.count (or ic, ingestCount): The total number of documents that are processed by the model.
  • ingest.current (or icurr, ingestCurrent): The total number of document that are currently being handled by the trained model.
  • ingest.failed (or if, ingestFailed): The total number of failed ingest attempts with the trained model.
  • ingest.pipelines (or ip, ingestPipelines): The total number of ingest pipelines that are referencing the trained model.
  • ingest.time (or it, ingestTime): The total time that is spent processing documents with the trained model.
  • license (or l): The license level of the trained model.
  • operations (or o, modelOperations): The estimated number of operations to use the trained model. This number helps measuring the computational complexity of the model.
  • version (or v): The Elasticsearch version number in which the trained model was created.
• s string | array[string]

  A comma-separated list of column names or aliases used to sort the response.

  Supported values include:

  • create_time (or ct): The time when the trained model was created.
  • created_by (or c, createdBy): Information on the creator of the trained model.
  • data_frame_analytics_id (or df, dataFrameAnalytics, dfid): Identifier for the data frame analytics job that created the model. Only displayed if it is still available.
  • description (or d): The description of the trained model.
  • heap_size (or hs, modelHeapSize): The estimated heap size to keep the trained model in memory.
  • id: Identifier for the trained model.
  • ingest.count (or ic, ingestCount): The total number of documents that are processed by the model.
  • ingest.current (or icurr, ingestCurrent): The total number of document that are currently being handled by the trained model.
  • ingest.failed (or if, ingestFailed): The total number of failed ingest attempts with the trained model.
  • ingest.pipelines (or ip, ingestPipelines): The total number of ingest pipelines that are referencing the trained model.
  • ingest.time (or it, ingestTime): The total time that is spent processing documents with the trained model.
  • license (or l): The license level of the trained model.
  • operations (or o, modelOperations): The estimated number of operations to use the trained model. This number helps measuring the computational complexity of the model.
  • version (or v): The Elasticsearch version number in which the trained model was created.
• from number

  Skips the specified number of transforms.

• size number

  The maximum number of transforms to display.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • created_by string

    Information about the creator of the model.

  • heap_size number | string

    One of:

    ByteSize number ByteSize string
  • operations string

    The estimated number of operations to use the model. This number helps to measure the computational complexity of the model.

  • license string

    The license level of the model.

  • create_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • version string
  • description string

    A description of the model.

  • ingest.pipelines string

    The number of pipelines that are referencing the model.

  • ingest.count string

    The total number of documents that are processed by the model.

  • ingest.time string

    The total time spent processing documents with thie model.

  • ingest.current string

    The total number of documents that are currently being handled by the model.

  • ingest.failed string

    The total number of failed ingest attempts with the model.

  • data_frame.id string

    The identifier for the data frame analytics job that created the model. Only displayed if the job is still available.

  • data_frame.create_time string

    The time the data frame analytics job was created.

  • data_frame.source_index string

    The source index used to train in the data frame analysis.

  • data_frame.analysis string

    The analysis used by the data frame to build the model.

  • type string

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• full_id boolean | string

  If true, return the full node ID. If false, return the shortened node ID.

• include_unloaded_segments boolean

  If true, the response includes information from segments that are not loaded into memory.

• h string | array[string]

  A comma-separated list of columns names to display. It supports simple wildcards.

  Supported values include:

  • build (or b): The Elasticsearch build hash. For example: 5c03844.
  • completion.size (or cs, completionSize): The size of completion. For example: 0b.
  • cpu: The percentage of recent system CPU used.
  • disk.avail (or d, disk, diskAvail): The available disk space. For example: 198.4gb.
  • disk.total (or dt, diskTotal): The total disk space. For example: 458.3gb.
  • disk.used (or du, diskUsed): The used disk space. For example: 259.8gb.
  • disk.used_percent (or dup, diskUsedPercent): The percentage of disk space used.
  • fielddata.evictions (or fe, fielddataEvictions): The number of fielddata cache evictions.
  • fielddata.memory_size (or fm, fielddataMemory): The fielddata cache memory used. For example: 0b.
  • file_desc.current (or fdc, fileDescriptorCurrent): The number of file descriptors used.
  • file_desc.max (or fdm, fileDescriptorMax): The maximum number of file descriptors.
  • file_desc.percent (or fdp, fileDescriptorPercent): The percentage of file descriptors used.
  • flush.total (or ft, flushTotal): The number of flushes.
  • flush.total_time (or ftt, flushTotalTime): The amount of time spent in flush.
  • get.current (or gc, getCurrent): The number of current get operations.
  • get.exists_time (or geti, getExistsTime): The time spent in successful get operations. For example: 14ms.
  • get.exists_total (or geto, getExistsTotal): The number of successful get operations.
  • get.missing_time (or gmti, getMissingTime): The time spent in failed get operations. For example: 0s.
  • get.missing_total (or gmto, getMissingTotal): The number of failed get operations.
  • get.time (or gti, getTime): The amount of time spent in get operations. For example: 14ms.
  • get.total (or gto, getTotal): The number of get operations.
  • heap.current (or hc, heapCurrent): The used heap size. For example: 311.2mb.
  • heap.max (or hm, heapMax): The total heap size. For example: 4gb.
  • heap.percent (or hp, heapPercent): The used percentage of total allocated Elasticsearch JVM heap. This value reflects only the Elasticsearch process running within the operating system and is the most direct indicator of its JVM, heap, or memory resource performance.
  • http_address (or http): The bound HTTP address.
  • id (or nodeId): The identifier for the node.
  • indexing.delete_current (or idc, indexingDeleteCurrent): The number of current deletion operations.
  • indexing.delete_time (or idti, indexingDeleteTime): The time spent in deletion operations. For example: 2ms.
  • indexing.delete_total (or idto, indexingDeleteTotal): The number of deletion operations.
  • indexing.index_current (or iic, indexingIndexCurrent): The number of current indexing operations.
  • indexing.index_failed (or iif, indexingIndexFailed): The number of failed indexing operations.
  • indexing.index_failed_due_to_version_conflict (or iifvc, indexingIndexFailedDueToVersionConflict): The number of indexing operations that failed due to version conflict.
  • indexing.index_time (or iiti, indexingIndexTime): The time spent in indexing operations. For example: 134ms.
  • indexing.index_total (or iito, indexingIndexTotal): The number of indexing operations.
  • ip (or i): The IP address.
  • jdk (or j): The Java version. For example: 1.8.0.
  • load_1m (or l): The most recent load average. For example: 0.22.
  • load_5m (or l): The load average for the last five minutes. For example: 0.78.
  • load_15m (or l): The load average for the last fifteen minutes. For example: 1.24.
  • mappings.total_count (or mtc, mappingsTotalCount): The number of mappings, including runtime and object fields.
  • mappings.total_estimated_overhead_in_bytes (or mteo, mappingsTotalEstimatedOverheadInBytes): The estimated heap overhead, in bytes, of mappings on this node, which allows for 1KiB of heap for every mapped field.
  • master (or m): Indicates whether the node is the elected master node. Returned values include * (elected master) and - (not elected master).
  • merges.current (or mc, mergesCurrent): The number of current merge operations.
  • merges.current_docs (or mcd, mergesCurrentDocs): The number of current merging documents.
  • merges.current_size (or mcs, mergesCurrentSize): The size of current merges. For example: 0b.
  • merges.total (or mt, mergesTotal): The number of completed merge operations.
  • merges.total_docs (or mtd, mergesTotalDocs): The number of merged documents.
  • merges.total_size (or mts, mergesTotalSize): The total size of merges. For example: 0b.
  • merges.total_time (or mtt, mergesTotalTime): The time spent merging documents. For example: 0s.
  • name (or n): The node name.
  • node.role (or r, role, nodeRole): The roles of the node. Returned values include c (cold node), d (data node), f (frozen node), h (hot node), i (ingest node), l (machine learning node), m (master-eligible node), r (remote cluster client node), s (content node), t (transform node), v (voting-only node), w (warm node), and - (coordinating node only). For example, dim indicates a master-eligible data and ingest node.
  • pid (or p): The process identifier.
  • port (or po): The bound transport port number.
  • query_cache.memory_size (or qcm, queryCacheMemory): The used query cache memory. For example: 0b.
  • query_cache.evictions (or qce, queryCacheEvictions): The number of query cache evictions.
  • query_cache.hit_count (or qchc, queryCacheHitCount): The query cache hit count.
  • query_cache.miss_count (or qcmc, queryCacheMissCount): The query cache miss count.
  • ram.current (or rc, ramCurrent): The used total memory. For example: 513.4mb.
  • ram.max (or rm, ramMax): The total memory. For example: 2.9gb.
  • ram.percent (or rp, ramPercent): The used percentage of the total operating system memory. This reflects all processes running on the operating system instead of only Elasticsearch and is not guaranteed to correlate to its performance.
  • refresh.total (or rto, refreshTotal): The number of refresh operations.
  • refresh.time (or rti, refreshTime): The time spent in refresh operations. For example: 91ms.
  • request_cache.memory_size (or rcm, requestCacheMemory): The used request cache memory. For example: 0b.
  • request_cache.evictions (or rce, requestCacheEvictions): The number of request cache evictions.
  • request_cache.hit_count (or rchc, requestCacheHitCount): The request cache hit count.
  • request_cache.miss_count (or rcmc, requestCacheMissCount): The request cache miss count.
  • script.compilations (or scrcc, scriptCompilations): The number of total script compilations.
  • script.cache_evictions (or scrce, scriptCacheEvictions): The number of total compiled scripts evicted from cache.
  • search.fetch_current (or sfc, searchFetchCurrent): The number of current fetch phase operations.
  • search.fetch_time (or sfti, searchFetchTime): The time spent in fetch phase. For example: 37ms.
  • search.fetch_total (or sfto, searchFetchTotal): The number of fetch operations.
  • search.open_contexts (or so, searchOpenContexts): The number of open search contexts.
  • search.query_current (or sqc, searchQueryCurrent): The number of current query phase operations.
  • search.query_time (or sqti, searchQueryTime): The time spent in query phase. For example: 43ms.
  • search.query_total (or sqto, searchQueryTotal): The number of query operations.
  • search.scroll_current (or scc, searchScrollCurrent): The number of open scroll contexts.
  • search.scroll_time (or scti, searchScrollTime): The amount of time scroll contexts were held open. For example: 2m.
  • search.scroll_total (or scto, searchScrollTotal): The number of completed scroll contexts.
  • segments.count (or sc, segmentsCount): The number of segments.
  • segments.fixed_bitset_memory (or sfbm, fixedBitsetMemory): The memory used by fixed bit sets for nested object field types and type filters for types referred in join fields. For example: 1.0kb.
  • segments.index_writer_memory (or siwm, segmentsIndexWriterMemory): The memory used by the index writer. For example: 18mb.
  • segments.memory (or sm, segmentsMemory): The memory used by segments. For example: 1.4kb.
  • segments.version_map_memory (or svmm, segmentsVersionMapMemory): The memory used by the version map. For example: 1.0kb.
  • shard_stats.total_count (or sstc, shards, shardStatsTotalCount): The number of shards assigned.
  • suggest.current (or suc, suggestCurrent): The number of current suggest operations.
  • suggest.time (or suti, suggestTime): The time spent in suggest operations.
  • suggest.total (or suto, suggestTotal): The number of suggest operations.
  • uptime (or u): The amount of node uptime. For example: 17.3m.
  • version (or v): The Elasticsearch version. For example: 9.0.0.
• s string | array[string]

  A comma-separated list of column names or aliases that determines the sort order. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• master_timeout string

  The period to wait for a connection to the master node.

• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • pid string

    The process identifier.

  • ip string

    The IP address.

  • port string

    The bound transport port.

  • http_address string

    The bound HTTP address.

  • version string
  • flavor string

    The Elasticsearch distribution flavor.

  • type string

    The Elasticsearch distribution type.

  • build string

    The Elasticsearch build hash.

  • jdk string

    The Java version.

  • disk.total number | string

    One of:

    ByteSize number ByteSize string

  • disk.used number | string

    One of:

    ByteSize number ByteSize string

  • disk.avail number | string

    One of:

    ByteSize number ByteSize string

  • disk.used_percent string | number

    One of:

    Percentage string Percentage number
  • heap.current string

    The used heap.

  • heap.percent string | number

    One of:

    Percentage string Percentage number
  • heap.max string

    The maximum configured heap.

  • ram.current string

    The used machine memory.

  • ram.percent string | number

    One of:

    Percentage string Percentage number
  • ram.max string

    The total machine memory.

  • file_desc.current string

    The used file descriptors.

  • file_desc.percent string | number

    One of:

    Percentage string Percentage number
  • file_desc.max string

    The maximum number of file descriptors.

  • cpu string

    The recent system CPU usage as a percentage.

  • load_1m string

    The load average for the most recent minute.

  • load_5m string

    The load average for the last five minutes.

  • load_15m string

    The load average for the last fifteen minutes.

  • uptime string

    The node uptime.

  • node.role string

    The roles of the node. Returned values include c(cold node), d(data node), f(frozen node), h(hot node), i(ingest node), l(machine learning node), m (master eligible node), r(remote cluster client node), s(content node), t(transform node), v(voting-only node), w(warm node),and -(coordinating node only).

  • master string

    Indicates whether the node is the elected master node. Returned values include *(elected master) and -(not elected master).

  • name string
  • completion.size string

    The size of completion.

  • fielddata.memory_size string

    The used fielddata cache.

  • fielddata.evictions string

    The fielddata evictions.

  • query_cache.memory_size string

    The used query cache.

  • query_cache.evictions string

    The query cache evictions.

  • query_cache.hit_count string

    The query cache hit counts.

  • query_cache.miss_count string

    The query cache miss counts.

  • request_cache.memory_size string

    The used request cache.

  • request_cache.evictions string

    The request cache evictions.

  • request_cache.hit_count string

    The request cache hit counts.

  • request_cache.miss_count string

    The request cache miss counts.

  • flush.total string

    The number of flushes.

  • flush.total_time string

    The time spent in flush.

  • get.current string

    The number of current get ops.

  • get.time string

    The time spent in get.

  • get.total string

    The number of get ops.

  • get.exists_time string

    The time spent in successful gets.

  • get.exists_total string

    The number of successful get operations.

  • get.missing_time string

    The time spent in failed gets.

  • get.missing_total string

    The number of failed gets.

  • indexing.delete_current string

    The number of current deletions.

  • indexing.delete_time string

    The time spent in deletions.

  • indexing.delete_total string

    The number of delete operations.

  • indexing.index_current string

    The number of current indexing operations.

  • indexing.index_time string

    The time spent in indexing.

  • indexing.index_total string

    The number of indexing operations.

  • indexing.index_failed string

    The number of failed indexing operations.

  • merges.current string

    The number of current merges.

  • merges.current_docs string

    The number of current merging docs.

  • merges.current_size string

    The size of current merges.

  • merges.total string

    The number of completed merge operations.

  • merges.total_docs string

    The docs merged.

  • merges.total_size string

    The size merged.

  • merges.total_time string

    The time spent in merges.

  • refresh.total string

    The total refreshes.

  • refresh.time string

    The time spent in refreshes.

  • refresh.external_total string

    The total external refreshes.

  • refresh.external_time string

    The time spent in external refreshes.

  • refresh.listeners string

    The number of pending refresh listeners.

  • script.compilations string

    The total script compilations.

  • script.cache_evictions string

    The total compiled scripts evicted from the cache.

  • script.compilation_limit_triggered string

    The script cache compilation limit triggered.

  • search.fetch_current string

    The current fetch phase operations.

  • search.fetch_time string

    The time spent in fetch phase.

  • search.fetch_total string

    The total fetch operations.

  • search.open_contexts string

    The open search contexts.

  • search.query_current string

    The current query phase operations.

  • search.query_time string

    The time spent in query phase.

  • search.query_total string

    The total query phase operations.

  • search.scroll_current string

    The open scroll contexts.

  • search.scroll_time string

    The time scroll contexts held open.

  • search.scroll_total string

    The completed scroll contexts.

  • segments.count string

    The number of segments.

  • segments.memory string

    The memory used by segments.

  • segments.index_writer_memory string

    The memory used by the index writer.

  • segments.version_map_memory string

    The memory used by the version map.

  • segments.fixed_bitset_memory string

    The memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields.

  • suggest.current string

    The number of current suggest operations.

  • suggest.time string

    The time spend in suggest.

  • suggest.total string

    The number of suggest operations.

  • bulk.total_operations string

    The number of bulk shard operations.

  • bulk.total_time string

    The time spend in shard bulk.

  • bulk.total_size_in_bytes string

    The total size in bytes of shard bulk.

  • bulk.avg_time string

    The average time spend in shard bulk.

  • bulk.avg_size_in_bytes string

    The average size in bytes of shard bulk.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • insertOrder string

    The task insertion order.

  • timeInQueue string

    Indicates how long the task has been in queue.

  • priority string

    The task priority.

  • source string

    The task source.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• include_bootstrap boolean

  Include bootstrap plugins in the response

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • name string
  • component string

    The component name.

  • version string
  • description string

    The plugin details.

  • type string

    The plugin type.

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• active_only boolean

  If true, the response only includes ongoing shard recoveries.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• detailed boolean

  If true, the response includes detailed information about shard recoveries.

• index string | array[string]

  Comma-separated list or wildcard expression of index names to limit the returned information

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string
  • shard string

    The shard name.

  • start_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • start_time_millis number

    Time unit for milliseconds

  • stop_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • stop_time_millis number

    Time unit for milliseconds

  • time string

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

  • type string

    The recovery type.

  • stage string

    The recovery stage.

  • source_host string

    The source host.

  • source_node string

    The source node name.

  • target_host string

    The target host.

  • target_node string

    The target node name.

  • repository string

    The repository name.

  • snapshot string

    The snapshot name.

  • files string

    The number of files to recover.

  • files_recovered string

    The files recovered.

  • files_percent string | number

    One of:

    Percentage string Percentage number
  • files_total string

    The total number of files.

  • bytes string

    The number of bytes to recover.

  • bytes_recovered string

    The bytes recovered.

  • bytes_percent string | number

    One of:

    Percentage string Percentage number
  • bytes_total string

    The total number of bytes.

  • translog_ops string

    The number of translog operations to recover.

  • translog_ops_recovered string

    The translog operations recovered.

  • translog_ops_percent string | number

    One of:

    Percentage string Percentage number