Get anomaly detection job results for influencers | Elasticsearch API documentation (v9)

Get anomaly detection job results for influencers Generally available; Added in 5.4.0

POST /_ml/anomaly_detectors/{job_id}/results/influencers

All methods and paths for this operation:

GET /_ml/anomaly_detectors/{job_id}/results/influencers

POST /_ml/anomaly_detectors/{job_id}/results/influencers

Influencers are the entities that have contributed to, or are to blame for, the anomalies. Influencer results are available only if an influencer_field_name is specified in the job configuration.

Required authorization

Cluster privileges: monitor_ml

Path parameters

job_id string Required

Identifier for the anomaly detection job.

Query parameters

desc boolean

If true, the results are sorted in descending order.

Default value is false.
end

Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.

Default value is -1.
exclude_interim boolean

If true, the output excludes interim results. By default, interim results are included.

Default value is false.
influencer_score number

Returns influencers with anomaly scores greater than or equal to this value.

Default value is 0.
from number

Skips the specified number of influencers.

Default value is 0.
size number

Specifies the maximum number of influencers to obtain.

Default value is 100.
sort string

Specifies the sort field for the requested influencers. By default, the influencers are sorted by the influencer_score value.
start

Returns influencers with timestamps after this time. The default value means it is unset and results are not limited to specific timestamps.

Default value is -1.

application/json

Body

page object

Configures pagination. This parameter has the from and size properties.
Hide page attributes Show page attributes object
- from number
  
  Skips the specified number of items.
  
  Default value is 0.
- size number
  
  Specifies the maximum number of items to obtain.
  
  Default value is 10000.

Responses

200 application/json
Hide response attributes Show response attributes object
- count number Required
- influencers array[object] Required
  
  Array of influencer objects
  
  Hide influencers attributes Show influencers attributes object
  
  bucket_span number Required
  
  The length of the bucket in seconds. This value matches the bucket span that is specified in the job.
  
  influencer_score number Required
  
  A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated across detectors. Unlike initial_influencer_score, this value is updated by a re-normalization process as new data is analyzed.
  
  influencer_field_name string Required
  
  The field name of the influencer.
  
  influencer_field_value string Required
  
  The entity that influenced, contributed to, or was to blame for the anomaly.
  
  initial_influencer_score number Required
  
  A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors. This is the initial value that was calculated at the time the bucket was processed.
  
  is_interim boolean Required
  
  If true, this is an interim result. In other words, the results are calculated based on partial input data.
  
  job_id string Required
  
  Identifier for the anomaly detection job.
  
  probability number Required
  
  The probability that the influencer has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the influencer_score is provided as a human-readable and friendly interpretation of this value.
  
  result_type string Required
  
  Internal. This value is always set to influencer.
  
  timestamp number Required
  
  The start time of the bucket for which these results were calculated.
  
  foo string
  
  Additional influencer properties are added, depending on the fields being analyzed. For example, if it’s analyzing user_name as an influencer, a field user_name is added to the result document. This information enables you to filter the anomaly results more easily.

POST /_ml/anomaly_detectors/{job_id}/results/influencers

GET _ml/anomaly_detectors/high_sum_total_sales/results/influencers?desc=true&sort="influencer_score"

resp = client.ml.get_influencers(
    job_id="high_sum_total_sales",
    desc=True,
    sort="\"influencer_score\"",
)

const response = await client.ml.getInfluencers({
  job_id: "high_sum_total_sales",
  desc: "true",
  sort: '"influencer_score"',
});

response = client.ml.get_influencers(
  job_id: "high_sum_total_sales",
  desc: "true",
  sort: "\"influencer_score\""
)

$resp = $client->ml()->getInfluencers([
    "job_id" => "high_sum_total_sales",
    "desc" => "true",
    "sort" => "\"influencer_score\"",
]);

curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/results/influencers?desc=true&sort="influencer_score""

var response = await client.MachineLearning
    .GetInfluencersAsync(jobId: "high_sum_total_sales", d1 => d1
        .Desc(true)
        .Sort("\"influencer_score\"")
    );

client.ml().getInfluencers(g -> g
    .desc(true)
    .jobId("high_sum_total_sales")
    .sort(""influencer_score"")
);