Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  The period to wait for a connection to the master node.

  Values are -1 or 0.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • name string Required

  • version string | null Required

    One of:

    string-1 string string-2 string | null
  • alias_count string Required
  • mapping_count string Required
  • settings_count string Required
  • metadata_count string Required
  • included_in string Required

Path parameters

• job_id string Required

  Identifier for the anomaly detection job.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no jobs that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.

  Values are assignment_explanation, ae, buckets.count, bc, bucketsCount, buckets.time.exp_avg, btea, bucketsTimeExpAvg, buckets.time.exp_avg_hour, bteah, bucketsTimeExpAvgHour, buckets.time.max, btmax, bucketsTimeMax, buckets.time.min, btmin, bucketsTimeMin, buckets.time.total, btt, bucketsTimeTotal, data.buckets, db, dataBuckets, data.earliest_record, der, dataEarliestRecord, data.empty_buckets, deb, dataEmptyBuckets, data.input_bytes, dib, dataInputBytes, data.input_fields, dif, dataInputFields, data.input_records, dir, dataInputRecords, data.invalid_dates, did, dataInvalidDates, data.last, dl, dataLast, data.last_empty_bucket, dleb, dataLastEmptyBucket, data.last_sparse_bucket, dlsb, dataLastSparseBucket, data.latest_record, dlr, dataLatestRecord, data.missing_fields, dmf, dataMissingFields, data.out_of_order_timestamps, doot, dataOutOfOrderTimestamps, data.processed_fields, dpf, dataProcessedFields, data.processed_records, dpr, dataProcessedRecords, data.sparse_buckets, dsb, dataSparseBuckets, forecasts.memory.avg, fmavg, forecastsMemoryAvg, forecasts.memory.max, fmmax, forecastsMemoryMax, forecasts.memory.min, fmmin, forecastsMemoryMin, forecasts.memory.total, fmt, forecastsMemoryTotal, forecasts.records.avg, fravg, forecastsRecordsAvg, forecasts.records.max, frmax, forecastsRecordsMax, forecasts.records.min, frmin, forecastsRecordsMin, forecasts.records.total, frt, forecastsRecordsTotal, forecasts.time.avg, ftavg, forecastsTimeAvg, forecasts.time.max, ftmax, forecastsTimeMax, forecasts.time.min, ftmin, forecastsTimeMin, forecasts.time.total, ftt, forecastsTimeTotal, forecasts.total, ft, forecastsTotal, id, model.bucket_allocation_failures, mbaf, modelBucketAllocationFailures, model.by_fields, mbf, modelByFields, model.bytes, mb, modelBytes, model.bytes_exceeded, mbe, modelBytesExceeded, model.categorization_status, mcs, modelCategorizationStatus, model.categorized_doc_count, mcdc, modelCategorizedDocCount, model.dead_category_count, mdcc, modelDeadCategoryCount, model.failed_category_count, modelFailedCategoryCount, model.frequent_category_count, mfcc, modelFrequentCategoryCount, model.log_time, mlt, modelLogTime, model.memory_limit, mml, modelMemoryLimit, model.memory_status, mms, modelMemoryStatus, model.over_fields, mof, modelOverFields, model.partition_fields, mpf, modelPartitionFields, model.rare_category_count, mrcc, modelRareCategoryCount, model.timestamp, mt, modelTimestamp, model.total_category_count, mtcc, modelTotalCategoryCount, node.address, na, nodeAddress, node.ephemeral_id, ne, nodeEphemeralId, node.id, ni, nodeId, node.name, nn, nodeName, opened_time, ot, state, or s.

  Show More
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.

  Values are assignment_explanation, ae, buckets.count, bc, bucketsCount, buckets.time.exp_avg, btea, bucketsTimeExpAvg, buckets.time.exp_avg_hour, bteah, bucketsTimeExpAvgHour, buckets.time.max, btmax, bucketsTimeMax, buckets.time.min, btmin, bucketsTimeMin, buckets.time.total, btt, bucketsTimeTotal, data.buckets, db, dataBuckets, data.earliest_record, der, dataEarliestRecord, data.empty_buckets, deb, dataEmptyBuckets, data.input_bytes, dib, dataInputBytes, data.input_fields, dif, dataInputFields, data.input_records, dir, dataInputRecords, data.invalid_dates, did, dataInvalidDates, data.last, dl, dataLast, data.last_empty_bucket, dleb, dataLastEmptyBucket, data.last_sparse_bucket, dlsb, dataLastSparseBucket, data.latest_record, dlr, dataLatestRecord, data.missing_fields, dmf, dataMissingFields, data.out_of_order_timestamps, doot, dataOutOfOrderTimestamps, data.processed_fields, dpf, dataProcessedFields, data.processed_records, dpr, dataProcessedRecords, data.sparse_buckets, dsb, dataSparseBuckets, forecasts.memory.avg, fmavg, forecastsMemoryAvg, forecasts.memory.max, fmmax, forecastsMemoryMax, forecasts.memory.min, fmmin, forecastsMemoryMin, forecasts.memory.total, fmt, forecastsMemoryTotal, forecasts.records.avg, fravg, forecastsRecordsAvg, forecasts.records.max, frmax, forecastsRecordsMax, forecasts.records.min, frmin, forecastsRecordsMin, forecasts.records.total, frt, forecastsRecordsTotal, forecasts.time.avg, ftavg, forecastsTimeAvg, forecasts.time.max, ftmax, forecastsTimeMax, forecasts.time.min, ftmin, forecastsTimeMin, forecasts.time.total, ftt, forecastsTimeTotal, forecasts.total, ft, forecastsTotal, id, model.bucket_allocation_failures, mbaf, modelBucketAllocationFailures, model.by_fields, mbf, modelByFields, model.bytes, mb, modelBytes, model.bytes_exceeded, mbe, modelBytesExceeded, model.categorization_status, mcs, modelCategorizationStatus, model.categorized_doc_count, mcdc, modelCategorizedDocCount, model.dead_category_count, mdcc, modelDeadCategoryCount, model.failed_category_count, modelFailedCategoryCount, model.frequent_category_count, mfcc, modelFrequentCategoryCount, model.log_time, mlt, modelLogTime, model.memory_limit, mml, modelMemoryLimit, model.memory_status, mms, modelMemoryStatus, model.over_fields, mof, modelOverFields, model.partition_fields, mpf, modelPartitionFields, model.rare_category_count, mrcc, modelRareCategoryCount, model.timestamp, mt, modelTimestamp, model.total_category_count, mtcc, modelTotalCategoryCount, node.address, na, nodeAddress, node.ephemeral_id, ne, nodeEphemeralId, node.id, ni, nodeId, node.name, nn, nodeName, opened_time, ot, state, or s.

  Show More
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • state string

    Values are closing, closed, opened, failed, or opening.

  • opened_time string

    For open jobs only, the amount of time the job has been opened.

  • assignment_explanation string

    For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

  • data.processed_records string

    The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed_record_count is the number of aggregation results processed, not the number of Elasticsearch documents.

  • data.processed_fields string

    The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.

  • data.input_bytes number | string

    One of:

    ByteSize number ByteSize string
  • data.input_records string

    The number of input documents posted to the anomaly detection job.

  • data.input_fields string

    The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.

  • data.invalid_dates string

    The number of input documents with either a missing date field or a date that could not be parsed.

  • data.missing_fields string

    The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing. If you are using datafeeds or posting data to the job in JSON format, a high missing_field_count is often not an indication of data issues. It is not necessarily a cause for concern.

  • data.out_of_order_timestamps string

    The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.

  • data.empty_buckets string

    The number of buckets which did not contain any data. If your data contains many empty buckets, consider increasing your bucket_span or using functions that are tolerant to gaps in data such as mean, non_null_sum or non_zero_count.

  • data.sparse_buckets string

    The number of buckets that contained few data points compared to the expected number of data points. If your data contains many sparse buckets, consider using a longer bucket_span.

  • data.buckets string

    The total number of buckets processed.

  • data.earliest_record string

    The timestamp of the earliest chronologically input document.

  • data.latest_record string

    The timestamp of the latest chronologically input document.

  • data.last string

    The timestamp at which data was last analyzed, according to server time.

  • data.last_empty_bucket string

    The timestamp of the last bucket that did not contain any data.

  • data.last_sparse_bucket string

    The timestamp of the last bucket that was considered sparse.

  • model.bytes number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_status string

    Values are ok, soft_limit, or hard_limit.

  • model.bytes_exceeded number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_limit string

    The upper limit for model memory usage, checked on increasing values.

  • model.by_fields string

    The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.over_fields string

    The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.partition_fields string

    The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.bucket_allocation_failures string

    The number of buckets for which new entities in incoming data were not processed due to insufficient model memory. This situation is also signified by a hard_limit: memory_status property value.

  • model.categorization_status string

    Values are ok or warn.

  • model.categorized_doc_count string

    The number of documents that have had a field categorized.

  • model.total_category_count string

    The number of categories created by categorization.

  • model.frequent_category_count string

    The number of categories that match more than 1% of categorized documents.

  • model.rare_category_count string

    The number of categories that match just one categorized document.

  • model.dead_category_count string

    The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.

  • model.failed_category_count string

    The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model_memory_limit. This count does not track which specific categories failed to be created. Therefore you cannot use this value to determine the number of unique categories that were missed.

  • model.log_time string

    The timestamp when the model stats were gathered, according to server time.

  • model.timestamp string

    The timestamp of the last record when the model stats were gathered.

  • forecasts.total string

    The number of individual forecasts currently available for the job. A value of one or more indicates that forecasts exist.

  • forecasts.memory.min string

    The minimum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.max string

    The maximum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.avg string

    The average memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.total string

    The total memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.records.min string

    The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.max string

    The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.avg string

    The average number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.total string

    The total number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.time.min string

    The minimum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.max string

    The maximum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.avg string

    The average runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.total string

    The total runtime in milliseconds for forecasts related to the anomaly detection job.

  • node.id string
  • node.name string

    The name of the assigned node.

  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

  • buckets.count string

    The number of bucket results produced by the job.

  • buckets.time.total string

    The sum of all bucket processing times, in milliseconds.

  • buckets.time.min string

    The minimum of all bucket processing times, in milliseconds.

  • buckets.time.max string

    The maximum of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg string

    The exponential moving average of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg_hour string

    The exponential moving average of bucket processing times calculated in a one hour time window, in milliseconds.

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• active_only boolean

  If true, the response only includes ongoing shard recoveries.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• detailed boolean

  If true, the response includes detailed information about shard recoveries.

• index string | array[string]

  Comma-separated list or wildcard expression of index names to limit the returned information

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string
  • shard string

    The shard name.

  • start_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • start_time_millis number

    Time unit for milliseconds

  • stop_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • stop_time_millis number

    Time unit for milliseconds

  • time string

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

  • type string

    The recovery type.

  • stage string

    The recovery stage.

  • source_host string

    The source host.

  • source_node string

    The source node name.

  • target_host string

    The target host.

  • target_node string

    The target node name.

  • repository string

    The repository name.

  • snapshot string

    The snapshot name.

  • files string

    The number of files to recover.

  • files_recovered string

    The files recovered.

  • files_percent string | number

    One of:

    Percentage string Percentage number
  • files_total string

    The total number of files.

  • bytes string

    The number of bytes to recover.

  • bytes_recovered string

    The bytes recovered.

  • bytes_percent string | number

    One of:

    Percentage string Percentage number
  • bytes_total string

    The total number of bytes.

  • translog_ops string

    The number of translog operations to recover.

  • translog_ops_recovered string

    The translog operations recovered.

  • translog_ops_percent string | number

    One of:

    Percentage string Percentage number

Path parameters

• node_id string | array[string] Required

  Comma-separated list of node IDs or names used to limit returned information.

• max_archive_version number Required

  Specifies the maximum archive_version to be cleared from the archive.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • _nodes object
    Hide _nodes attributes Show _nodes attributes object

    • failures array[object]
      Hide failures attributes Show failures attributes object

      • type string Required

        The type of error

      • reason string

        A human-readable explanation of the error, in English.

      • stack_trace string

        The server stack trace. Present only if the error_trace=true parameter was sent with the request.

      • caused_by object
      • root_cause array[object]
      • suppressed array[object]
    • total number Required

      Total number of nodes selected by the request.

    • successful number Required

      Number of nodes that responded successfully to the request.

    • failed number Required

      Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response.

  • cluster_name string Required
  • nodes object Required

    Contains repositories metering information for the nodes selected by the request.

    Hide nodes attribute Show nodes attribute object

    • * object Additional properties
      Hide * attributes Show * attributes object

      • repository_name string Required
      • repository_type string Required

        Repository type.

      • repository_location object Required
        Hide repository_location attributes Show repository_location attributes object

        • base_path string Required
        • container string

          Container name (Azure)

        • bucket string

          Bucket name (GCP, S3)

      • repository_ephemeral_id string Required

      • Time unit for milliseconds

      • Time unit for milliseconds

      • archived boolean Required

        A flag that tells whether or not this object has been archived. When a repository is closed or updated the repository metering information is archived and kept for a certain period of time. This allows retrieving the repository metering information of previous repository instantiations.

      • cluster_version number
      • request_counts object Required
        Hide request_counts attributes Show request_counts attributes object

        • GetBlobProperties number

          Number of Get Blob Properties requests (Azure)

        • GetBlob number

          Number of Get Blob requests (Azure)

        • ListBlobs number

          Number of List Blobs requests (Azure)

        • PutBlob number

          Number of Put Blob requests (Azure)

        • PutBlock number

          Number of Put Block (Azure)

        • PutBlockList number

          Number of Put Block List requests

        • GetObject number

          Number of get object requests (GCP, S3)

        • ListObjects number

          Number of list objects requests (GCP, S3)

        • InsertObject number

          Number of insert object requests, including simple, multipart and resumable uploads. Resumable uploads can perform multiple http requests to insert a single object but they are considered as a single request since they are billed as an individual operation. (GCP)

        • PutObject number

          Number of PutObject requests (S3)

        • PutMultipartObject number

          Number of Multipart requests, including CreateMultipartUpload, UploadPart and CompleteMultipartUpload requests (S3)

Path parameters

• metric string | array[string] Required

  Limit the information returned to the specified metrics

• index_metric string | array[string] Required

  Limit the information returned for indices metric to the specific index metrics. It can be used only if indices (or all) metric is specified.

Query parameters

• completion_fields string | array[string]

  Comma-separated list or wildcard expressions of fields to include in fielddata and suggest statistics.

• fielddata_fields string | array[string]

  Comma-separated list or wildcard expressions of fields to include in fielddata statistics.

• fields string | array[string]

  Comma-separated list or wildcard expressions of fields to include in the statistics.

• groups boolean

  Comma-separated list of search groups to include in the search statistics.

• include_segment_file_sizes boolean

  If true, the call reports the aggregated disk usage of each one of the Lucene index files (only applies if segment stats are requested).

• level string

  Indicates whether statistics are aggregated at the cluster, index, or shard level.

  Values are cluster, indices, or shards.

• timeout string

  Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

  Values are -1 or 0.

• types array[string]

  A comma-separated list of document types for the indexing index metric.

• include_unloaded_segments boolean

  If true, the response includes information from segments that are not loaded into memory.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • _nodes object
    Hide _nodes attributes Show _nodes attributes object

    • failures array[object]
      Hide failures attributes Show failures attributes object

      • type string Required

        The type of error

      • reason string

        A human-readable explanation of the error, in English.

      • stack_trace string

        The server stack trace. Present only if the error_trace=true parameter was sent with the request.

      • caused_by object
      • root_cause array[object]
      • suppressed array[object]
    • total number Required

      Total number of nodes selected by the request.

    • successful number Required

      Number of nodes that responded successfully to the request.

    • failed number Required

      Number of nodes that rejected the request or failed to respond. If this value is not 0, a reason for the rejection or failure is included in the response.

  • cluster_name string
  • nodes object Required
    Hide nodes attribute Show nodes attribute object

    • * object Additional properties
      Hide * attributes Show * attributes object

      • adaptive_selection object

        Statistics about adaptive replica selection.

        Hide adaptive_selection attribute Show adaptive_selection attribute object

        • * object Additional properties
          Hide * attributes Show * attributes object

          • avg_queue_size number

            The exponentially weighted moving average queue size of search requests on the keyed node.

          • avg_response_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • avg_response_time_ns number

            The exponentially weighted moving average response time, in nanoseconds, of search requests on the keyed node.

          • avg_service_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • avg_service_time_ns number

            The exponentially weighted moving average service time, in nanoseconds, of search requests on the keyed node.

          • outgoing_searches number

            The number of outstanding search requests to the keyed node from the node these stats are for.

          • rank string

            The rank of this node; used for shard selection when routing search requests.

      • breakers object

        Statistics about the field data circuit breaker.

        Hide breakers attribute Show breakers attribute object

        • * object Additional properties
          Hide * attributes Show * attributes object

          • estimated_size string

            Estimated memory used for the operation.

          • estimated_size_in_bytes number

            Estimated memory used, in bytes, for the operation.

          • limit_size string

            Memory limit for the circuit breaker.

          • limit_size_in_bytes number

            Memory limit, in bytes, for the circuit breaker.

          • overhead number

            A constant that all estimates for the circuit breaker are multiplied with to calculate a final estimate.

          • tripped number

            Total number of times the circuit breaker has been triggered and prevented an out of memory error.

      • fs object
        Hide fs attributes Show fs attributes object

        • data array[object]

          List of all file stores.
        • timestamp number

          Last time the file stores statistics were refreshed. Recorded in milliseconds since the Unix Epoch.

        • total object
          Hide total attributes Show total attributes object

          • available string

            Total disk space available to this Java virtual machine on all file stores. Depending on OS or process level restrictions, this might appear less than free. This is the actual amount of free disk space the Elasticsearch node can utilise.

          • available_in_bytes number

            Total number of bytes available to this Java virtual machine on all file stores. Depending on OS or process level restrictions, this might appear less than free_in_bytes. This is the actual amount of free disk space the Elasticsearch node can utilise.

          • free string

            Total unallocated disk space in all file stores.

          • free_in_bytes number

            Total number of unallocated bytes in all file stores.

          • total string

            Total size of all file stores.

          • total_in_bytes number

            Total size of all file stores in bytes.

        • io_stats object
          Hide io_stats attributes Show io_stats attributes object

          • devices array[object]

            Array of disk metrics for each device that is backing an Elasticsearch data path. These disk metrics are probed periodically and averages between the last probe and the current probe are computed.

          • total object
      • host string
      • http object
        Hide http attributes Show http attributes object

        • current_open number

          Current number of open HTTP connections for the node.

        • total_opened number

          Total number of HTTP connections opened for the node.

        • clients array[object]

          Information on current and recently-closed HTTP client connections. Clients that have been closed longer than the http.client_stats.closed_channels.max_age setting will not be represented here.
        • routes object Required Added in 8.12.0

          Detailed HTTP stats broken down by route

          Hide routes attribute Show routes attribute object

          • * object Additional properties
      • ingest object
        Hide ingest attributes Show ingest attributes object

        • pipelines object

          Contains statistics about ingest pipelines for the node.

          Hide pipelines attribute Show pipelines attribute object

          • * object Additional properties
        • total object
          Hide total attributes Show total attributes object

          • count number Required

            Total number of documents ingested during the lifetime of this node.

          • current number Required

            Total number of documents currently being ingested.

          • failed number Required

            Total number of failed ingest operations during the lifetime of this node.

      • ip string | array[string]

        IP address and port for the node.

        One of:

        Ip string array-2 array[string]
      • jvm object
        Hide jvm attributes Show jvm attributes object

        • buffer_pools object

          Contains statistics about JVM buffer pools for the node.

          Hide buffer_pools attribute Show buffer_pools attribute object

          • * object Additional properties
        • classes object
          Hide classes attributes Show classes attributes object

          • current_loaded_count number

            Number of classes currently loaded by JVM.

          • total_loaded_count number

            Total number of classes loaded since the JVM started.

          • total_unloaded_count number

            Total number of classes unloaded since the JVM started.

        • gc object
          Hide gc attribute Show gc attribute object

          • collectors object

            Contains statistics about JVM garbage collectors for the node.

        • mem object
          Hide mem attributes Show mem attributes object

          • heap_used_in_bytes number

            Memory, in bytes, currently in use by the heap.

          • heap_used_percent number

            Percentage of memory currently in use by the heap.

          • heap_committed_in_bytes number

            Amount of memory, in bytes, available for use by the heap.

          • heap_max_in_bytes number

            Maximum amount of memory, in bytes, available for use by the heap.

          • non_heap_used_in_bytes number

            Non-heap memory used, in bytes.

          • non_heap_committed_in_bytes number

            Amount of non-heap memory available, in bytes.

          • pools object

            Contains statistics about heap memory usage for the node.

        • threads object
          Hide threads attributes Show threads attributes object

          • count number

            Number of active threads in use by JVM.

          • peak_count number

            Highest number of threads used by JVM.

        • timestamp number

          Last time JVM statistics were refreshed.

        • uptime string

          Human-readable JVM uptime. Only returned if the human query parameter is true.

        • uptime_in_millis number

          JVM uptime in milliseconds.

      • name string
      • os object
        Hide os attributes Show os attributes object

        • cpu object
          Hide cpu attributes Show cpu attributes object

          • percent number
          • sys string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • user string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • load_average object
        • swap object
          Hide swap attributes Show swap attributes object

          • adjusted_total_in_bytes number

            If the amount of physical memory has been overridden using the es.total_memory_bytes system property then this reports the overridden value in bytes. Otherwise it reports the same value as total_in_bytes.

          • resident string
          • resident_in_bytes number
          • share string
          • share_in_bytes number
          • total_virtual string
          • total_virtual_in_bytes number
          • total_in_bytes number

            Total amount of physical memory in bytes.

          • free_in_bytes number

            Amount of free physical memory in bytes.

          • used_in_bytes number

            Amount of used physical memory in bytes.

        • cgroup object
          Hide cgroup attributes Show cgroup attributes object

          • cpuacct object
          • cpu object
          • memory object
        • timestamp number
      • process object
        Hide process attributes Show process attributes object

        • cpu object
          Hide cpu attributes Show cpu attributes object

          • percent number
          • sys string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • user string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • load_average object
        • mem object
          Hide mem attributes Show mem attributes object

          • adjusted_total_in_bytes number

            If the amount of physical memory has been overridden using the es.total_memory_bytes system property then this reports the overridden value in bytes. Otherwise it reports the same value as total_in_bytes.

          • resident string
          • resident_in_bytes number
          • share string
          • share_in_bytes number
          • total_virtual string
          • total_virtual_in_bytes number
          • total_in_bytes number

            Total amount of physical memory in bytes.

          • free_in_bytes number

            Amount of free physical memory in bytes.

          • used_in_bytes number

            Amount of used physical memory in bytes.

        • open_file_descriptors number

          Number of opened file descriptors associated with the current or -1 if not supported.

        • max_file_descriptors number

          Maximum number of file descriptors allowed on the system, or -1 if not supported.

        • timestamp number

          Last time the statistics were refreshed. Recorded in milliseconds since the Unix Epoch.

      • roles array[string]
        • @doc_id node-roles

        Values are master, data, data_cold, data_content, data_frozen, data_hot, data_warm, client, ingest, ml, voting_only, transform, remote_cluster_client, or coordinating_only.

      • script object
        Hide script attributes Show script attributes object

        • cache_evictions number

          Total number of times the script cache has evicted old data.

        • compilations number

          Total number of inline script compilations performed by the node.

        • compilations_history object

          Contains this recent history of script compilations.

          Hide compilations_history attribute Show compilations_history attribute object

          • * number Additional properties
        • compilation_limit_triggered number

          Total number of times the script compilation circuit breaker has limited inline script compilations.

        • contexts array[object]
      • script_cache object
      • thread_pool object

        Statistics about each thread pool, including current size, queue and rejected tasks.

        Hide thread_pool attribute Show thread_pool attribute object

        • * object Additional properties
          Hide * attributes Show * attributes object

          • active number

            Number of active threads in the thread pool.

          • completed number

            Number of tasks completed by the thread pool executor.

          • largest number

            Highest number of active threads in the thread pool.

          • queue number

            Number of tasks in queue for the thread pool.

          • rejected number

            Number of tasks rejected by the thread pool executor.

          • threads number

            Number of threads in the thread pool.

      • timestamp number
      • transport object
        Hide transport attributes Show transport attributes object

        • inbound_handling_time_histogram array[object]

          The distribution of the time spent handling each inbound message on a transport thread, represented as a histogram.
        • outbound_handling_time_histogram array[object]

          The distribution of the time spent sending each outbound transport message on a transport thread, represented as a histogram.
        • rx_count number

          Total number of RX (receive) packets received by the node during internal cluster communication.

        • rx_size string

          Size of RX packets received by the node during internal cluster communication.

        • rx_size_in_bytes number

          Size, in bytes, of RX packets received by the node during internal cluster communication.

        • server_open number

          Current number of inbound TCP connections used for internal communication between nodes.

        • tx_count number

          Total number of TX (transmit) packets sent by the node during internal cluster communication.

        • tx_size string

          Size of TX packets sent by the node during internal cluster communication.

        • tx_size_in_bytes number

          Size, in bytes, of TX packets sent by the node during internal cluster communication.

        • total_outbound_connections number

          The cumulative number of outbound transport connections that this node has opened since it started. Each transport connection may comprise multiple TCP connections but is only counted once in this statistic. Transport connections are typically long-lived so this statistic should remain constant in a stable cluster.

      • transport_address string
      • attributes object

        Contains a list of attributes for the node.

        Hide attributes attribute Show attributes attribute object

        • * string Additional properties
      • discovery object
        Hide discovery attributes Show discovery attributes object

        • cluster_state_queue object
          Hide cluster_state_queue attributes Show cluster_state_queue attributes object

          • total number

            Total number of cluster states in queue.

          • pending number

            Number of pending cluster states in queue.

          • committed number

            Number of committed cluster states in queue.

        • published_cluster_states object
          Hide published_cluster_states attributes Show published_cluster_states attributes object

          • full_states number

            Number of published cluster states.

          • incompatible_diffs number

            Number of incompatible differences between published cluster states.

          • compatible_diffs number

            Number of compatible differences between published cluster states.

        • cluster_state_update object

          Contains low-level statistics about how long various activities took during cluster state updates while the node was the elected master. Omitted if the node is not master-eligible. Every field whose name ends in _time within this object is also represented as a raw number of milliseconds in a field whose name ends in _time_millis. The human-readable fields with a _time suffix are only returned if requested with the ?human=true query parameter.

          Hide cluster_state_update attribute Show cluster_state_update attribute object

          • * object Additional properties
        • serialized_cluster_states object
          Hide serialized_cluster_states attributes Show serialized_cluster_states attributes object

          • full_states object
          • diffs object
        • cluster_applier_stats object
          Hide cluster_applier_stats attribute Show cluster_applier_stats attribute object

          • recordings array[object]
      • indexing_pressure object
        Hide indexing_pressure attribute Show indexing_pressure attribute object

        • memory object
          Hide memory attributes Show memory attributes object

          • limit
          • limit_in_bytes number

            Configured memory limit, in bytes, for the indexing requests. Replica requests have an automatic limit that is 1.5x this value.

          • current object
          • total object
      • indices object
        Hide indices attributes Show indices attributes object

        • commit object
          Hide commit attributes Show commit attributes object

          • generation number Required
          • id string Required
          • num_docs number Required
          • user_data object Required
        • completion object
          Hide completion attributes Show completion attributes object

          • size_in_bytes number Required

            Total amount, in bytes, of memory used for completion across all shards assigned to selected nodes.

          • size
          • fields object
        • docs object
          Hide docs attributes Show docs attributes object

          • count number Required

            Total number of non-deleted documents across all primary shards assigned to selected nodes. This number is based on documents in Lucene segments and may include documents from nested fields.

          • deleted number

            Total number of deleted documents across all primary shards assigned to selected nodes. This number is based on documents in Lucene segments. Elasticsearch reclaims the disk space of deleted Lucene documents when a segment is merged.

        • fielddata object
          Hide fielddata attributes Show fielddata attributes object

          • evictions number
          • memory_size
          • memory_size_in_bytes number Required
          • fields object
        • flush object
          Hide flush attributes Show flush attributes object

          • periodic number Required
          • total number Required
          • total_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • get object
          Hide get attributes Show get attributes object

          • current number Required
          • exists_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • exists_total number Required
          • missing_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • missing_total number Required
          • time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total number Required
        • indexing object
          Hide indexing attributes Show indexing attributes object

          • index_current number Required
          • delete_current number Required
          • delete_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • delete_total number Required
          • is_throttled boolean Required
          • noop_update_total number Required
          • throttle_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • index_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • index_total number Required
          • index_failed number Required
          • types object
          • write_load number
        • mappings object
          Hide mappings attributes Show mappings attributes object

          • total_count number Required
          • total_estimated_overhead
          • total_estimated_overhead_in_bytes number Required
        • merges object
          Hide merges attributes Show merges attributes object

          • current number Required
          • current_docs number Required
          • current_size string
          • current_size_in_bytes number Required
          • total number Required
          • total_auto_throttle string
          • total_auto_throttle_in_bytes number Required
          • total_docs number Required
          • total_size string
          • total_size_in_bytes number Required
          • total_stopped_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total_throttled_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • shard_path object
          Hide shard_path attributes Show shard_path attributes object

          • data_path string Required
          • is_custom_data_path boolean Required
          • state_path string Required
        • query_cache object
          Hide query_cache attributes Show query_cache attributes object

          • cache_count number Required
          • cache_size number Required
          • evictions number Required
          • hit_count number Required
          • memory_size_in_bytes number Required
          • miss_count number Required
          • total_count number Required
        • recovery object
          Hide recovery attributes Show recovery attributes object

          • current_as_source number Required
          • current_as_target number Required
          • throttle_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • refresh object
          Hide refresh attributes Show refresh attributes object

          • external_total number Required
          • listeners number Required
          • total number Required
          • total_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • request_cache object
          Hide request_cache attributes Show request_cache attributes object

          • evictions number Required
          • hit_count number Required
          • memory_size string
          • memory_size_in_bytes number Required
          • miss_count number Required
        • retention_leases object
          Hide retention_leases attributes Show retention_leases attributes object

          • primary_term number Required
          • version number Required
          • leases array[object] Required
        • routing object
          Hide routing attributes Show routing attributes object

          • node string Required
          • primary boolean Required
          • relocating_node
          • state string Required

            Values are UNASSIGNED, INITIALIZING, STARTED, or RELOCATING.

        • search object
          Hide search attributes Show search attributes object

          • fetch_current number Required
          • fetch_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • fetch_total number Required
          • open_contexts number
          • query_current number Required
          • query_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • query_total number Required
          • scroll_current number Required
          • scroll_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • scroll_total number Required
          • suggest_current number Required
          • suggest_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • suggest_total number Required
          • groups object
        • segments object
          Hide segments attributes Show segments attributes object

          • count number Required

            Total number of segments across all shards assigned to selected nodes.

          • doc_values_memory
          • doc_values_memory_in_bytes number Required

            Total amount, in bytes, of memory used for doc values across all shards assigned to selected nodes.

          • file_sizes object Required

            This object is not populated by the cluster stats API. To get information on segment files, use the node stats API.

          • fixed_bit_set
          • fixed_bit_set_memory_in_bytes number Required

            Total amount of memory, in bytes, used by fixed bit sets across all shards assigned to selected nodes.

          • index_writer_memory
          • index_writer_max_memory_in_bytes number
          • index_writer_memory_in_bytes number Required

            Total amount, in bytes, of memory used by all index writers across all shards assigned to selected nodes.

          • max_unsafe_auto_id_timestamp number Required

            Unix timestamp, in milliseconds, of the most recently retried indexing request.

          • memory
          • memory_in_bytes number Required

            Total amount, in bytes, of memory used for segments across all shards assigned to selected nodes.

          • norms_memory
          • norms_memory_in_bytes number Required

            Total amount, in bytes, of memory used for normalization factors across all shards assigned to selected nodes.

          • points_memory
          • points_memory_in_bytes number Required

            Total amount, in bytes, of memory used for points across all shards assigned to selected nodes.

          • stored_memory
          • stored_fields_memory_in_bytes number Required

            Total amount, in bytes, of memory used for stored fields across all shards assigned to selected nodes.

          • terms_memory_in_bytes number Required

            Total amount, in bytes, of memory used for terms across all shards assigned to selected nodes.

          • terms_memory
          • term_vectory_memory
          • term_vectors_memory_in_bytes number Required

            Total amount, in bytes, of memory used for term vectors across all shards assigned to selected nodes.

          • version_map_memory
          • version_map_memory_in_bytes number Required

            Total amount, in bytes, of memory used by all version maps across all shards assigned to selected nodes.

        • seq_no object
          Hide seq_no attributes Show seq_no attributes object

          • global_checkpoint number Required
          • local_checkpoint number Required
          • max_seq_no number Required
        • store object
          Hide store attributes Show store attributes object

          • size
          • size_in_bytes number Required

            Total size, in bytes, of all shards assigned to selected nodes.

          • reserved
          • reserved_in_bytes number Required

            A prediction, in bytes, of how much larger the shard stores will eventually grow due to ongoing peer recoveries, restoring snapshots, and similar activities.

          • total_data_set_size
          • total_data_set_size_in_bytes number

            Total data set size, in bytes, of all shards assigned to selected nodes. This includes the size of shards not stored fully on the nodes, such as the cache for partially mounted indices.

        • translog object
          Hide translog attributes Show translog attributes object

          • earliest_last_modified_age number Required
          • operations number Required
          • size string
          • size_in_bytes number Required
          • uncommitted_operations number Required
          • uncommitted_size string
          • uncommitted_size_in_bytes number Required
        • warmer object
          Hide warmer attributes Show warmer attributes object

          • current number Required
          • total number Required
          • total_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

        • bulk object
          Hide bulk attributes Show bulk attributes object

          • total_operations number Required
          • total_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • total_size
          • total_size_in_bytes number Required
          • avg_time string

            A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

          • avg_size
          • avg_size_in_bytes number Required
        • shards object
          Hide shards attribute Show shards attribute object

          • * object Additional properties
        • shard_stats object
          Hide shard_stats attribute Show shard_stats attribute object

          • total_count number Required
        • indices object Additional properties
          Hide indices attributes Show indices attributes object

          • primaries object
          • shards object
          • total object
          • uuid string
          • health string

            Values are green, GREEN, yellow, YELLOW, red, or RED.

          • status string

            Values are open or close.