Path parameters

• name array[string] Required

  A list of analytics collections to limit the returned information

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • * object Additional properties
    Hide * attribute Show * attribute object

    • event_data_stream object Required
      Hide event_data_stream attribute Show event_data_stream attribute object

      • name string Required

Responses

• 200 application/json
  Hide response attribute Show response attribute object

  • * object Additional properties
    Hide * attribute Show * attribute object

    • event_data_stream object Required
      Hide event_data_stream attribute Show event_data_stream attribute object

      • name string Required

Path parameters

• name string | array[string] Required

  A comma-separated list of aliases to retrieve. Supports wildcards (*). To retrieve all aliases, omit this parameter or use * or _all.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• expand_wildcards string | array[string]

  The type of index that wildcard patterns can match. If the request can target data streams, this argument determines whether wildcard expressions match hidden data streams. It supports comma-separated values, such as open,hidden.

  Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
• master_timeout string

  The period to wait for a connection to the master node. If the master node is not available before the timeout expires, the request fails and returns an error. To indicated that the request should never timeout, you can set it to -1.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • alias string

    alias name

  • index string
  • filter string

    filter

  • routing.index string

    index routing

  • routing.search string

    search routing

  • is_write_index string

    write index

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • shards string

    Number of primary and replica shards assigned to the node.

  • shards.undesired string | null

    Amount of shards that are scheduled to be moved elsewhere in the cluster or -1 other than desired balance allocator is used

    One of:

    string-1 string string-2 string | null

  • write_load.forecast number | string | null

    Sum of index write load forecasts

    One of:

    Stringifieddouble number Stringifieddouble string string-2 string | null

  • disk.indices.forecast number | string | null

    Sum of shard size forecasts

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.indices number | string | null

    Disk space used by the node’s shards. Does not include disk space for the translog or unassigned shards. IMPORTANT: This metric double-counts disk space for hard-linked files, such as those created when shrinking, splitting, or cloning an index.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.used number | string | null

    Total disk space in use. Elasticsearch retrieves this metric from the node’s operating system (OS). The metric includes disk space for: Elasticsearch, including the translog and unassigned shards; the node’s operating system; any other applications or files on the node. Unlike disk.indices, this metric does not double-count disk space for hard-linked files.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.avail number | string | null

    Free disk space available to Elasticsearch. Elasticsearch retrieves this metric from the node’s operating system. Disk-based shard allocation uses this metric to assign shards to nodes based on available disk space.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.total number | string | null

    Total disk space for the node, including in-use and available space.

    One of:

    ByteSize number ByteSize string string-2 string | null

  • disk.percent string | number | null

    Total percentage of disk space in use. Calculated as disk.used / disk.total.

    One of:

    Percentage string Percentage number string-2 string | null

  • host string | null

    Network host for the node. Set using the network.host setting.

    One of:

    Host string string-2 string | null

  • ip string | null

    IP address and port for the node.

    One of:

    Ip string string-2 string | null
  • node string

    Name for the node. Set using the node.name setting.

  • node.role string | null

    Node roles

    One of:

    string-1 string string-2 string | null

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  The period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • name string Required

  • version string | null Required

    One of:

    string-1 string string-2 string | null
  • alias_count string Required
  • mapping_count string Required
  • settings_count string Required
  • metadata_count string Required
  • included_in string Required

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number StringifiedEpochTimeUnitSeconds string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • count string

    the document count

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. It supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • epoch number | string

    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.

    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.

    One of:

    UnitSeconds number StringifiedEpochTimeUnitSeconds string

    Time unit for seconds
  • timestamp string

    Time of day, expressed as HH:MM:SS

  • count string

    the document count

Path parameters

• fields string | array[string] Required

  Comma-separated list of fields used to limit returned information. To retrieve all fields, omit this parameter.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• fields string | array[string]

  Comma-separated list of fields used to limit returned information.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

  • field string

    field name

  • size string

    field data usage

Responses

• 200 application/json

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• expand_wildcards string | array[string]

  The type of index that wildcard patterns can match.

  Supported values include:

  • all: Match any data stream or index, including hidden ones.
  • open: Match open, non-hidden indices. Also matches any non-hidden data stream.
  • closed: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.
  • hidden: Match hidden data streams and hidden indices. Must be combined with open, closed, or both.
  • none: Wildcard expressions are not accepted.
• health string

  The health status used to limit returned indices. By default, the response includes indices of any health status.

  Supported values include:

  • green (or GREEN): All shards are assigned.
  • yellow (or YELLOW): All primary shards are assigned, but one or more replica shards are unassigned. If a node in the cluster fails, some data could be unavailable until that node is repaired.
  • red (or RED): One or more primary shards are unassigned, so some data is unavailable. This can occur briefly during cluster startup as primary shards are assigned.

  Values are green, GREEN, yellow, YELLOW, red, or RED.

• include_unloaded_segments boolean

  If true, the response includes information from segments that are not loaded into memory.

• pri boolean

  If true, the response only includes information from primary shards.

• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

• master_timeout string

  Period to wait for a connection to the master node.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • health string

    current health status

  • status string

    open/close status

  • index string

    index name

  • uuid string

    index uuid

  • pri string

    number of primary shards

  • rep string

    number of replica shards

  • docs.count string | null

    available docs

    One of:

    string-1 string string-2 string | null

  • docs.deleted string | null

    deleted docs

    One of:

    string-1 string string-2 string | null
  • creation.date string

    index creation date (millisecond value)

  • creation.date.string string

    index creation date (as string)

  • store.size string | null

    store size of primaries & replicas

    One of:

    string-1 string string-2 string | null

  • pri.store.size string | null

    store size of primaries

    One of:

    string-1 string string-2 string | null

  • dataset.size string | null

    total size of dataset (including the cache for partially mounted indices)

    One of:

    string-1 string string-2 string | null
  • completion.size string

    size of completion

  • pri.completion.size string

    size of completion

  • fielddata.memory_size string

    used fielddata cache

  • pri.fielddata.memory_size string

    used fielddata cache

  • fielddata.evictions string

    fielddata evictions

  • pri.fielddata.evictions string

    fielddata evictions

  • query_cache.memory_size string

    used query cache

  • pri.query_cache.memory_size string

    used query cache

  • query_cache.evictions string

    query cache evictions

  • pri.query_cache.evictions string

    query cache evictions

  • request_cache.memory_size string

    used request cache

  • pri.request_cache.memory_size string

    used request cache

  • request_cache.evictions string

    request cache evictions

  • pri.request_cache.evictions string

    request cache evictions

  • request_cache.hit_count string

    request cache hit count

  • pri.request_cache.hit_count string

    request cache hit count

  • request_cache.miss_count string

    request cache miss count

  • pri.request_cache.miss_count string

    request cache miss count

  • flush.total string

    number of flushes

  • pri.flush.total string

    number of flushes

  • flush.total_time string

    time spent in flush

  • pri.flush.total_time string

    time spent in flush

  • get.current string

    number of current get ops

  • pri.get.current string

    number of current get ops

  • get.time string

    time spent in get

  • pri.get.time string

    time spent in get

  • get.total string

    number of get ops

  • pri.get.total string

    number of get ops

  • get.exists_time string

    time spent in successful gets

  • pri.get.exists_time string

    time spent in successful gets

  • get.exists_total string

    number of successful gets

  • pri.get.exists_total string

    number of successful gets

  • get.missing_time string

    time spent in failed gets

  • pri.get.missing_time string

    time spent in failed gets

  • get.missing_total string

    number of failed gets

  • pri.get.missing_total string

    number of failed gets

  • indexing.delete_current string

    number of current deletions

  • pri.indexing.delete_current string

    number of current deletions

  • indexing.delete_time string

    time spent in deletions

  • pri.indexing.delete_time string

    time spent in deletions

  • indexing.delete_total string

    number of delete ops

  • pri.indexing.delete_total string

    number of delete ops

  • indexing.index_current string

    number of current indexing ops

  • pri.indexing.index_current string

    number of current indexing ops

  • indexing.index_time string

    time spent in indexing

  • pri.indexing.index_time string

    time spent in indexing

  • indexing.index_total string

    number of indexing ops

  • pri.indexing.index_total string

    number of indexing ops

  • indexing.index_failed string

    number of failed indexing ops

  • pri.indexing.index_failed string

    number of failed indexing ops

  • merges.current string

    number of current merges

  • pri.merges.current string

    number of current merges

  • merges.current_docs string

    number of current merging docs

  • pri.merges.current_docs string

    number of current merging docs

  • merges.current_size string

    size of current merges

  • pri.merges.current_size string

    size of current merges

  • merges.total string

    number of completed merge ops

  • pri.merges.total string

    number of completed merge ops

  • merges.total_docs string

    docs merged

  • pri.merges.total_docs string

    docs merged

  • merges.total_size string

    size merged

  • pri.merges.total_size string

    size merged

  • merges.total_time string

    time spent in merges

  • pri.merges.total_time string

    time spent in merges

  • refresh.total string

    total refreshes

  • pri.refresh.total string

    total refreshes

  • refresh.time string

    time spent in refreshes

  • pri.refresh.time string

    time spent in refreshes

  • refresh.external_total string

    total external refreshes

  • pri.refresh.external_total string

    total external refreshes

  • refresh.external_time string

    time spent in external refreshes

  • pri.refresh.external_time string

    time spent in external refreshes

  • refresh.listeners string

    number of pending refresh listeners

  • pri.refresh.listeners string

    number of pending refresh listeners

  • search.fetch_current string

    current fetch phase ops

  • pri.search.fetch_current string

    current fetch phase ops

  • search.fetch_time string

    time spent in fetch phase

  • pri.search.fetch_time string

    time spent in fetch phase

  • search.fetch_total string

    total fetch ops

  • pri.search.fetch_total string

    total fetch ops

  • search.open_contexts string

    open search contexts

  • pri.search.open_contexts string

    open search contexts

  • search.query_current string

    current query phase ops

  • pri.search.query_current string

    current query phase ops

  • search.query_time string

    time spent in query phase

  • pri.search.query_time string

    time spent in query phase

  • search.query_total string

    total query phase ops

  • pri.search.query_total string

    total query phase ops

  • search.scroll_current string

    open scroll contexts

  • pri.search.scroll_current string

    open scroll contexts

  • search.scroll_time string

    time scroll contexts held open

  • pri.search.scroll_time string

    time scroll contexts held open

  • search.scroll_total string

    completed scroll contexts

  • pri.search.scroll_total string

    completed scroll contexts

  • segments.count string

    number of segments

  • pri.segments.count string

    number of segments

  • segments.memory string

    memory used by segments

  • pri.segments.memory string

    memory used by segments

  • segments.index_writer_memory string

    memory used by index writer

  • pri.segments.index_writer_memory string

    memory used by index writer

  • segments.version_map_memory string

    memory used by version map

  • pri.segments.version_map_memory string

    memory used by version map

  • segments.fixed_bitset_memory string

    memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields

  • pri.segments.fixed_bitset_memory string

    memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields

  • warmer.current string

    current warmer ops

  • pri.warmer.current string

    current warmer ops

  • warmer.total string

    total warmer ops

  • pri.warmer.total string

    total warmer ops

  • warmer.total_time string

    time spent in warmers

  • pri.warmer.total_time string

    time spent in warmers

  • suggest.current string

    number of current suggest ops

  • pri.suggest.current string

    number of current suggest ops

  • suggest.time string

    time spend in suggest

  • pri.suggest.time string

    time spend in suggest

  • suggest.total string

    number of suggest ops

  • pri.suggest.total string

    number of suggest ops

  • memory.total string

    total used memory

  • pri.memory.total string

    total user memory

  • search.throttled string

    indicates if the index is search throttled

  • bulk.total_operations string

    number of bulk shard ops

  • pri.bulk.total_operations string

    number of bulk shard ops

  • bulk.total_time string

    time spend in shard bulk

  • pri.bulk.total_time string

    time spend in shard bulk

  • bulk.total_size_in_bytes string

    total size in bytes of shard bulk

  • pri.bulk.total_size_in_bytes string

    total size in bytes of shard bulk

  • bulk.avg_time string

    average time spend in shard bulk

  • pri.bulk.avg_time string

    average time spend in shard bulk

  • bulk.avg_size_in_bytes string

    average size in bytes of shard bulk

  • pri.bulk.avg_size_in_bytes string

    average size in bytes of shard bulk

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    node id

  • host string

    host name

  • ip string

    ip address

  • node string

    node name

Path parameters

• id string Required

  The ID of the data frame analytics to fetch

Query parameters

• allow_no_match boolean

  Whether to ignore if a wildcard expression matches no configs. (This includes _all string or when no configs have been specified)

• bytes string

  The unit in which to display byte values

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): Contains messages relating to the selection of a node.
  • create_time (or ct, createTime): The time when the data frame analytics job was created.
  • description (or d): A description of a job.
  • dest_index (or di, destIndex): Name of the destination index.
  • failure_reason (or fr, failureReason): Contains messages about the reason why a data frame analytics job failed.
  • id: Identifier for the data frame analytics job.
  • model_memory_limit (or mml, modelMemoryLimit): The approximate maximum amount of memory resources that are permitted for the data frame analytics job.
  • node.address (or na, nodeAddress): The network address of the node that the data frame analytics job is assigned to.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that the data frame analytics job is assigned to.
  • node.id (or ni, nodeId): The unique identifier of the node that the data frame analytics job is assigned to.
  • node.name (or nn, nodeName): The name of the node that the data frame analytics job is assigned to.
  • progress (or p): The progress report of the data frame analytics job by phase.
  • source_index (or si, sourceIndex): Name of the source index.
  • state (or s): Current state of the data frame analytics job.
  • type (or t): The type of analysis that the data frame analytics job performs.
  • version (or v): The Elasticsearch version number in which the data frame analytics job was created.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): Contains messages relating to the selection of a node.
  • create_time (or ct, createTime): The time when the data frame analytics job was created.
  • description (or d): A description of a job.
  • dest_index (or di, destIndex): Name of the destination index.
  • failure_reason (or fr, failureReason): Contains messages about the reason why a data frame analytics job failed.
  • id: Identifier for the data frame analytics job.
  • model_memory_limit (or mml, modelMemoryLimit): The approximate maximum amount of memory resources that are permitted for the data frame analytics job.
  • node.address (or na, nodeAddress): The network address of the node that the data frame analytics job is assigned to.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that the data frame analytics job is assigned to.
  • node.id (or ni, nodeId): The unique identifier of the node that the data frame analytics job is assigned to.
  • node.name (or nn, nodeName): The name of the node that the data frame analytics job is assigned to.
  • progress (or p): The progress report of the data frame analytics job by phase.
  • source_index (or si, sourceIndex): Name of the source index.
  • state (or s): Current state of the data frame analytics job.
  • type (or t): The type of analysis that the data frame analytics job performs.
  • version (or v): The Elasticsearch version number in which the data frame analytics job was created.
• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • type string

    The type of analysis that the job performs.

  • create_time string

    The time when the job was created.

  • version string
  • source_index string
  • dest_index string
  • description string

    A description of the job.

  • model_memory_limit string

    The approximate maximum amount of memory resources that are permitted for the job.

  • state string

    The current status of the job.

  • failure_reason string

    Messages about the reason why the job failed.

  • progress string

    The progress report for the job by phase.

  • assignment_explanation string

    Messages related to the selection of a node.

  • node.id string
  • node.name string
  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no datafeeds that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    The datafeed identifier.

  • state string

    Values are started, stopped, starting, or stopping.

  • assignment_explanation string

    For started datafeeds only, contains messages relating to the selection of a node.

  • buckets.count string

    The number of buckets processed.

  • search.count string

    The number of searches run by the datafeed.

  • search.time string

    The total time the datafeed spent searching, in milliseconds.

  • search.bucket_avg string

    The average search time per bucket, in milliseconds.

  • search.exp_avg_hour string

    The exponential average search time per hour, in milliseconds.

  • node.id string

    The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.name string

    The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.ephemeral_id string

    The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.address string

    The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

Path parameters

• datafeed_id string Required

  A numerical character string that uniquely identifies the datafeed.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no datafeeds that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • ae (or assignment_explanation): For started datafeeds only, contains messages relating to the selection of a node.
  • bc (or buckets.count, bucketsCount): The number of buckets processed.
  • id: A numerical character string that uniquely identifies the datafeed.
  • na (or node.address, nodeAddress): For started datafeeds only, the network address of the node where the datafeed is started.
  • ne (or node.ephemeral_id, nodeEphemeralId): For started datafeeds only, the ephemeral ID of the node where the datafeed is started.
  • ni (or node.id, nodeId): For started datafeeds only, the unique identifier of the node where the datafeed is started.
  • nn (or node.name, nodeName): For started datafeeds only, the name of the node where the datafeed is started.
  • sba (or search.bucket_avg, searchBucketAvg): The average search time per bucket, in milliseconds.
  • sc (or search.count, searchCount): The number of searches run by the datafeed.
  • seah (or search.exp_avg_hour, searchExpAvgHour): The exponential average search time per hour, in milliseconds.
  • st (or search.time, searchTime): The total time the datafeed spent searching, in milliseconds.
  • s (or state): The status of the datafeed: starting, started, stopping, or stopped. If starting, the datafeed has been requested to start but has not yet started. If started, the datafeed is actively receiving data. If stopping, the datafeed has been requested to stop gracefully and is completing its final action. If stopped, the datafeed is stopped and will not receive data until it is re-started.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string

    The datafeed identifier.

  • state string

    Values are started, stopped, starting, or stopping.

  • assignment_explanation string

    For started datafeeds only, contains messages relating to the selection of a node.

  • buckets.count string

    The number of buckets processed.

  • search.count string

    The number of searches run by the datafeed.

  • search.time string

    The total time the datafeed spent searching, in milliseconds.

  • search.bucket_avg string

    The average search time per bucket, in milliseconds.

  • search.exp_avg_hour string

    The exponential average search time per hour, in milliseconds.

  • node.id string

    The unique identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.name string

    The name of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.ephemeral_id string

    The ephemeral identifier of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

  • node.address string

    The network address of the assigned node. For started datafeeds only, this information pertains to the node upon which the datafeed is started.

Query parameters

• allow_no_match boolean

  Specifies what to do when the request:

  • Contains wildcard expressions and there are no jobs that match.
  • Contains the _all string or no identifiers and there are no matches.
  • Contains wildcard expressions and there are only partial matches.

  If true, the API returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If false, the API returns a 404 status code when there are no matches or only partial matches.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  Comma-separated list of column names to display.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• s string | array[string]

  Comma-separated list of column names or column aliases used to sort the response.

  Supported values include:

  • assignment_explanation (or ae): For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.
  • buckets.count (or bc, bucketsCount): The number of bucket results produced by the job.
  • buckets.time.exp_avg (or btea, bucketsTimeExpAvg): Exponential moving average of all bucket processing times, in milliseconds.
  • buckets.time.exp_avg_hour (or bteah, bucketsTimeExpAvgHour): Exponentially-weighted moving average of bucket processing times calculated in a 1 hour time window, in milliseconds.
  • buckets.time.max (or btmax, bucketsTimeMax): Maximum among all bucket processing times, in milliseconds.
  • buckets.time.min (or btmin, bucketsTimeMin): Minimum among all bucket processing times, in milliseconds.
  • buckets.time.total (or btt, bucketsTimeTotal): Sum of all bucket processing times, in milliseconds.
  • data.buckets (or db, dataBuckets): The number of buckets processed.
  • data.earliest_record (or der, dataEarliestRecord): The timestamp of the earliest chronologically input document.
  • data.empty_buckets (or deb, dataEmptyBuckets): The number of buckets which did not contain any data.
  • data.input_bytes (or dib, dataInputBytes): The number of bytes of input data posted to the anomaly detection job.
  • data.input_fields (or dif, dataInputFields): The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.
  • data.input_records (or dir, dataInputRecords): The number of input documents posted to the anomaly detection job.
  • data.invalid_dates (or did, dataInvalidDates): The number of input documents with either a missing date field or a date that could not be parsed.
  • data.last (or dl, dataLast): The timestamp at which data was last analyzed, according to server time.
  • data.last_empty_bucket (or dleb, dataLastEmptyBucket): The timestamp of the last bucket that did not contain any data.
  • data.last_sparse_bucket (or dlsb, dataLastSparseBucket): The timestamp of the last bucket that was considered sparse.
  • data.latest_record (or dlr, dataLatestRecord): The timestamp of the latest chronologically input document.
  • data.missing_fields (or dmf, dataMissingFields): The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing.
  • data.out_of_order_timestamps (or doot, dataOutOfOrderTimestamps): The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.
  • data.processed_fields (or dpf, dataProcessedFields): The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.
  • data.processed_records (or dpr, dataProcessedRecords): The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed record count is the number of aggregation results processed, not the number of Elasticsearch documents.
  • data.sparse_buckets (or dsb, dataSparseBuckets): The number of buckets that contained few data points compared to the expected number of data points.
  • forecasts.memory.avg (or fmavg, forecastsMemoryAvg): The average memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.max (or fmmax, forecastsMemoryMax): The maximum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.min (or fmmin, forecastsMemoryMin): The minimum memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.memory.total (or fmt, forecastsMemoryTotal): The total memory usage in bytes for forecasts related to the anomaly detection job.
  • forecasts.records.avg (or fravg, forecastsRecordsAvg): The average number of model_forecast` documents written for forecasts related to the anomaly detection job.
  • forecasts.records.max (or frmax, forecastsRecordsMax): The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.min (or frmin, forecastsRecordsMin): The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.records.total (or frt, forecastsRecordsTotal): The total number of model_forecast documents written for forecasts related to the anomaly detection job.
  • forecasts.time.avg (or ftavg, forecastsTimeAvg): The average runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.max (or ftmax, forecastsTimeMax): The maximum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.min (or ftmin, forecastsTimeMin): The minimum runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.time.total (or ftt, forecastsTimeTotal): The total runtime in milliseconds for forecasts related to the anomaly detection job.
  • forecasts.total (or ft, forecastsTotal): The number of individual forecasts currently available for the job.
  • id: Identifier for the anomaly detection job.
  • model.bucket_allocation_failures (or mbaf, modelBucketAllocationFailures): The number of buckets for which new entities in incoming data were not processed due to insufficient model memory.
  • model.by_fields (or mbf, modelByFields): The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.bytes (or mb, modelBytes): The number of bytes of memory used by the models. This is the maximum value since the last time the model was persisted. If the job is closed, this value indicates the latest size.
  • model.bytes_exceeded (or mbe, modelBytesExceeded): The number of bytes over the high limit for memory usage at the last allocation failure.
  • model.categorization_status (or mcs, modelCategorizationStatus): The status of categorization for the job: ok or warn. If ok, categorization is performing acceptably well (or not being used at all). If warn, categorization is detecting a distribution of categories that suggests the input data is inappropriate for categorization. Problems could be that there is only one category, more than 90% of categories are rare, the number of categories is greater than 50% of the number of categorized documents, there are no frequently matched categories, or more than 50% of categories are dead.
  • model.categorized_doc_count (or mcdc, modelCategorizedDocCount): The number of documents that have had a field categorized.
  • model.dead_category_count (or mdcc, modelDeadCategoryCount): The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.
  • model.failed_category_count (or mdcc, modelFailedCategoryCount): The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model memory limit. This count does not track which specific categories failed to be created. Therefore, you cannot use this value to determine the number of unique categories that were missed.
  • model.frequent_category_count (or mfcc, modelFrequentCategoryCount): The number of categories that match more than 1% of categorized documents.
  • model.log_time (or mlt, modelLogTime): The timestamp when the model stats were gathered, according to server time.
  • model.memory_limit (or mml, modelMemoryLimit): The timestamp when the model stats were gathered, according to server time.
  • model.memory_status (or mms, modelMemoryStatus): The status of the mathematical models: ok, soft_limit, or hard_limit. If ok, the models stayed below the configured value. If soft_limit, the models used more than 60% of the configured memory limit and older unused models will be pruned to free up space. Additionally, in categorization jobs no further category examples will be stored. If hard_limit, the models used more space than the configured memory limit. As a result, not all incoming data was processed.
  • model.over_fields (or mof, modelOverFields): The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.partition_fields (or mpf, modelPartitionFields): The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.
  • model.rare_category_count (or mrcc, modelRareCategoryCount): The number of categories that match just one categorized document.
  • model.timestamp (or mt, modelTimestamp): The timestamp of the last record when the model stats were gathered.
  • model.total_category_count (or mtcc, modelTotalCategoryCount): The number of categories created by categorization.
  • node.address (or na, nodeAddress): The network address of the node that runs the job. This information is available only for open jobs.
  • node.ephemeral_id (or ne, nodeEphemeralId): The ephemeral ID of the node that runs the job. This information is available only for open jobs.
  • node.id (or ni, nodeId): The unique identifier of the node that runs the job. This information is available only for open jobs.
  • node.name (or nn, nodeName): The name of the node that runs the job. This information is available only for open jobs.
  • opened_time (or ot): For open jobs only, the elapsed time for which the job has been open.
  • state (or s): The status of the anomaly detection job: closed, closing, failed, opened, or opening. If closed, the job finished successfully with its model state persisted. The job must be opened before it can accept further data. If closing, the job close action is in progress and has not yet completed. A closing job cannot accept further data. If failed, the job did not finish successfully due to an error. This situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer. If the job had irrevocably failed, it must be force closed and then deleted. If the datafeed can be corrected, the job can be closed and then re-opened. If opened, the job is available to receive and process data. If opening, the job open action is in progress and has not yet completed.
• time string

  The unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • state string

    Values are closing, closed, opened, failed, or opening.

  • opened_time string

    For open jobs only, the amount of time the job has been opened.

  • assignment_explanation string

    For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job.

  • data.processed_records string

    The number of input documents that have been processed by the anomaly detection job. This value includes documents with missing fields, since they are nonetheless analyzed. If you use datafeeds and have aggregations in your search query, the processed_record_count is the number of aggregation results processed, not the number of Elasticsearch documents.

  • data.processed_fields string

    The total number of fields in all the documents that have been processed by the anomaly detection job. Only fields that are specified in the detector configuration object contribute to this count. The timestamp is not included in this count.

  • data.input_bytes number | string

    One of:

    ByteSize number ByteSize string
  • data.input_records string

    The number of input documents posted to the anomaly detection job.

  • data.input_fields string

    The total number of fields in input documents posted to the anomaly detection job. This count includes fields that are not used in the analysis. However, be aware that if you are using a datafeed, it extracts only the required fields from the documents it retrieves before posting them to the job.

  • data.invalid_dates string

    The number of input documents with either a missing date field or a date that could not be parsed.

  • data.missing_fields string

    The number of input documents that are missing a field that the anomaly detection job is configured to analyze. Input documents with missing fields are still processed because it is possible that not all fields are missing. If you are using datafeeds or posting data to the job in JSON format, a high missing_field_count is often not an indication of data issues. It is not necessarily a cause for concern.

  • data.out_of_order_timestamps string

    The number of input documents that have a timestamp chronologically preceding the start of the current anomaly detection bucket offset by the latency window. This information is applicable only when you provide data to the anomaly detection job by using the post data API. These out of order documents are discarded, since jobs require time series data to be in ascending chronological order.

  • data.empty_buckets string

    The number of buckets which did not contain any data. If your data contains many empty buckets, consider increasing your bucket_span or using functions that are tolerant to gaps in data such as mean, non_null_sum or non_zero_count.

  • data.sparse_buckets string

    The number of buckets that contained few data points compared to the expected number of data points. If your data contains many sparse buckets, consider using a longer bucket_span.

  • data.buckets string

    The total number of buckets processed.

  • data.earliest_record string

    The timestamp of the earliest chronologically input document.

  • data.latest_record string

    The timestamp of the latest chronologically input document.

  • data.last string

    The timestamp at which data was last analyzed, according to server time.

  • data.last_empty_bucket string

    The timestamp of the last bucket that did not contain any data.

  • data.last_sparse_bucket string

    The timestamp of the last bucket that was considered sparse.

  • model.bytes number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_status string

    Values are ok, soft_limit, or hard_limit.

  • model.bytes_exceeded number | string

    One of:

    ByteSize number ByteSize string
  • model.memory_limit string

    The upper limit for model memory usage, checked on increasing values.

  • model.by_fields string

    The number of by field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.over_fields string

    The number of over field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.partition_fields string

    The number of partition field values that were analyzed by the models. This value is cumulative for all detectors in the job.

  • model.bucket_allocation_failures string

    The number of buckets for which new entities in incoming data were not processed due to insufficient model memory. This situation is also signified by a hard_limit: memory_status property value.

  • model.categorization_status string

    Values are ok or warn.

  • model.categorized_doc_count string

    The number of documents that have had a field categorized.

  • model.total_category_count string

    The number of categories created by categorization.

  • model.frequent_category_count string

    The number of categories that match more than 1% of categorized documents.

  • model.rare_category_count string

    The number of categories that match just one categorized document.

  • model.dead_category_count string

    The number of categories created by categorization that will never be assigned again because another category’s definition makes it a superset of the dead category. Dead categories are a side effect of the way categorization has no prior training.

  • model.failed_category_count string

    The number of times that categorization wanted to create a new category but couldn’t because the job had hit its model_memory_limit. This count does not track which specific categories failed to be created. Therefore you cannot use this value to determine the number of unique categories that were missed.

  • model.log_time string

    The timestamp when the model stats were gathered, according to server time.

  • model.timestamp string

    The timestamp of the last record when the model stats were gathered.

  • forecasts.total string

    The number of individual forecasts currently available for the job. A value of one or more indicates that forecasts exist.

  • forecasts.memory.min string

    The minimum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.max string

    The maximum memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.avg string

    The average memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.memory.total string

    The total memory usage in bytes for forecasts related to the anomaly detection job.

  • forecasts.records.min string

    The minimum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.max string

    The maximum number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.avg string

    The average number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.records.total string

    The total number of model_forecast documents written for forecasts related to the anomaly detection job.

  • forecasts.time.min string

    The minimum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.max string

    The maximum runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.avg string

    The average runtime in milliseconds for forecasts related to the anomaly detection job.

  • forecasts.time.total string

    The total runtime in milliseconds for forecasts related to the anomaly detection job.

  • node.id string
  • node.name string

    The name of the assigned node.

  • node.ephemeral_id string
  • node.address string

    The network address of the assigned node.

  • buckets.count string

    The number of bucket results produced by the job.

  • buckets.time.total string

    The sum of all bucket processing times, in milliseconds.

  • buckets.time.min string

    The minimum of all bucket processing times, in milliseconds.

  • buckets.time.max string

    The maximum of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg string

    The exponential moving average of all bucket processing times, in milliseconds.

  • buckets.time.exp_avg_hour string

    The exponential moving average of bucket processing times calculated in a one hour time window, in milliseconds.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • insertOrder string

    The task insertion order.

  • timeInQueue string

    Indicates how long the task has been in queue.

  • priority string

    The task priority.

  • source string

    The task source.

Query parameters

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• include_bootstrap boolean

  Include bootstrap plugins in the response

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • id string
  • name string
  • component string

    The component name.

  • version string
  • description string

    The plugin details.

  • type string

    The plugin type.

Query parameters

• active_only boolean

  If true, the response only includes ongoing shard recoveries.

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• detailed boolean

  If true, the response includes detailed information about shard recoveries.

• index string | array[string]

  Comma-separated list or wildcard expression of index names to limit the returned information

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string
  • shard string

    The shard name.

  • start_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • start_time_millis number

    Time unit for milliseconds

  • stop_time string | number

    A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

    One of:

    DateTime string UnitMillis number

    Time unit for milliseconds

  • stop_time_millis number

    Time unit for milliseconds

  • time string

    A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.

  • type string

    The recovery type.

  • stage string

    The recovery stage.

  • source_host string

    The source host.

  • source_node string

    The source node name.

  • target_host string

    The target host.

  • target_node string

    The target node name.

  • repository string

    The repository name.

  • snapshot string

    The snapshot name.

  • files string

    The number of files to recover.

  • files_recovered string

    The files recovered.

  • files_percent string | number

    One of:

    Percentage string Percentage number
  • files_total string

    The total number of files.

  • bytes string

    The number of bytes to recover.

  • bytes_recovered string

    The bytes recovered.

  • bytes_percent string | number

    One of:

    Percentage string Percentage number
  • bytes_total string

    The total number of bytes.

  • translog_ops string

    The number of translog operations to recover.

  • translog_ops_recovered string

    The translog operations recovered.

  • translog_ops_percent string | number

    One of:

    Percentage string Percentage number

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• local boolean

  If true, the request computes the list of selected nodes from the local cluster state. If false the list of selected nodes are computed from the cluster state of the master node. In both cases the coordinating node will send requests for further information to each selected node.

• master_timeout string

  Period to wait for a connection to the master node.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string
  • shard string

    The shard name.

  • prirep string

    The shard type: primary or replica.

  • ip string

    The IP address of the node where it lives.

  • id string
  • segment string

    The segment name, which is derived from the segment generation and used internally to create file names in the directory of the shard.

  • generation string

    The segment generation number. Elasticsearch increments this generation number for each segment written then uses this number to derive the segment name.

  • docs.count string

    The number of documents in the segment. This excludes deleted documents and counts any nested documents separately from their parents. It also excludes documents which were indexed recently and do not yet belong to a segment.

  • docs.deleted string

    The number of deleted documents in the segment, which might be higher or lower than the number of delete operations you have performed. This number excludes deletes that were performed recently and do not yet belong to a segment. Deleted documents are cleaned up by the automatic merge process if it makes sense to do so. Also, Elasticsearch creates extra deleted documents to internally track the recent history of operations on a shard.

  • size number | string

    One of:

    ByteSize number ByteSize string

  • size.memory number | string

    One of:

    ByteSize number ByteSize string
  • committed string

    If true, the segment is synced to disk. Segments that are synced can survive a hard reboot. If false, the data from uncommitted segments is also stored in the transaction log so that Elasticsearch is able to replay changes on the next start.

  • searchable string

    If true, the segment is searchable. If false, the segment has most likely been written to disk but needs a refresh to be searchable.

  • version string
  • compound string

    If true, the segment is stored in a compound file. This means Lucene merged all files from the segment in a single file to save file descriptors.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• master_timeout string

  Period to wait for a connection to the master node.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string

    The index name.

  • shard string

    The shard name.

  • prirep string

    The shard type: primary or replica.

  • state string

    The shard state. Returned values include: INITIALIZING: The shard is recovering from a peer shard or gateway. RELOCATING: The shard is relocating. STARTED: The shard has started. UNASSIGNED: The shard is not assigned to any node.

  • docs string | null

    The number of documents in the shard.

    One of:

    string-1 string string-2 string | null

  • store string | null

    The disk space used by the shard.

    One of:

    string-1 string string-2 string | null

  • dataset string | null

    total size of dataset (including the cache for partially mounted indices)

    One of:

    string-1 string string-2 string | null

  • ip string | null

    The IP address of the node.

    One of:

    string-1 string string-2 string | null
  • id string

    The unique identifier for the node.

  • node string | null

    The name of node.

    One of:

    string-1 string string-2 string | null
  • sync_id string

    The sync identifier.

  • unassigned.reason string

    The reason for the last change to the state of an unassigned shard. It does not explain why the shard is currently unassigned; use the cluster allocation explain API for that information. Returned values include: ALLOCATION_FAILED: Unassigned as a result of a failed allocation of the shard. CLUSTER_RECOVERED: Unassigned as a result of a full cluster recovery. DANGLING_INDEX_IMPORTED: Unassigned as a result of importing a dangling index. EXISTING_INDEX_RESTORED: Unassigned as a result of restoring into a closed index. FORCED_EMPTY_PRIMARY: The shard’s allocation was last modified by forcing an empty primary using the cluster reroute API. INDEX_CLOSED: Unassigned because the index was closed. INDEX_CREATED: Unassigned as a result of an API creation of an index. INDEX_REOPENED: Unassigned as a result of opening a closed index. MANUAL_ALLOCATION: The shard’s allocation was last modified by the cluster reroute API. NEW_INDEX_RESTORED: Unassigned as a result of restoring into a new index. NODE_LEFT: Unassigned as a result of the node hosting it leaving the cluster. NODE_RESTARTING: Similar to NODE_LEFT, except that the node was registered as restarting using the node shutdown API. PRIMARY_FAILED: The shard was initializing as a replica, but the primary shard failed before the initialization completed. REALLOCATED_REPLICA: A better replica location is identified and causes the existing replica allocation to be cancelled. REINITIALIZED: When a shard moves from started back to initializing. REPLICA_ADDED: Unassigned as a result of explicit addition of a replica. REROUTE_CANCELLED: Unassigned as a result of explicit cancel reroute command.

  • unassigned.at string

    The time at which the shard became unassigned in Coordinated Universal Time (UTC).

  • unassigned.for string

    The time at which the shard was requested to be unassigned in Coordinated Universal Time (UTC).

  • unassigned.details string

    Additional details as to why the shard became unassigned. It does not explain why the shard is not assigned; use the cluster allocation explain API for that information.

  • recoverysource.type string

    The type of recovery source.

  • completion.size string

    The size of completion.

  • fielddata.memory_size string

    The used fielddata cache memory.

  • fielddata.evictions string

    The fielddata cache evictions.

  • query_cache.memory_size string

    The used query cache memory.

  • query_cache.evictions string

    The query cache evictions.

  • flush.total string

    The number of flushes.

  • flush.total_time string

    The time spent in flush.

  • get.current string

    The number of current get operations.

  • get.time string

    The time spent in get operations.

  • get.total string

    The number of get operations.

  • get.exists_time string

    The time spent in successful get operations.

  • get.exists_total string

    The number of successful get operations.

  • get.missing_time string

    The time spent in failed get operations.

  • get.missing_total string

    The number of failed get operations.

  • indexing.delete_current string

    The number of current deletion operations.

  • indexing.delete_time string

    The time spent in deletion operations.

  • indexing.delete_total string

    The number of delete operations.

  • indexing.index_current string

    The number of current indexing operations.

  • indexing.index_time string

    The time spent in indexing operations.

  • indexing.index_total string

    The number of indexing operations.

  • indexing.index_failed string

    The number of failed indexing operations.

  • merges.current string

    The number of current merge operations.

  • merges.current_docs string

    The number of current merging documents.

  • merges.current_size string

    The size of current merge operations.

  • merges.total string

    The number of completed merge operations.

  • merges.total_docs string

    The nuber of merged documents.

  • merges.total_size string

    The size of current merges.

  • merges.total_time string

    The time spent merging documents.

  • refresh.total string

    The total number of refreshes.

  • refresh.time string

    The time spent in refreshes.

  • refresh.external_total string

    The total nunber of external refreshes.

  • refresh.external_time string

    The time spent in external refreshes.

  • refresh.listeners string

    The number of pending refresh listeners.

  • search.fetch_current string

    The current fetch phase operations.

  • search.fetch_time string

    The time spent in fetch phase.

  • search.fetch_total string

    The total number of fetch operations.

  • search.open_contexts string

    The number of open search contexts.

  • search.query_current string

    The current query phase operations.

  • search.query_time string

    The time spent in query phase.

  • search.query_total string

    The total number of query phase operations.

  • search.scroll_current string

    The open scroll contexts.

  • search.scroll_time string

    The time scroll contexts were held open.

  • search.scroll_total string

    The number of completed scroll contexts.

  • segments.count string

    The number of segments.

  • segments.memory string

    The memory used by segments.

  • segments.index_writer_memory string

    The memory used by the index writer.

  • segments.version_map_memory string

    The memory used by the version map.

  • segments.fixed_bitset_memory string

    The memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields.

  • seq_no.max string

    The maximum sequence number.

  • seq_no.local_checkpoint string

    The local checkpoint.

  • seq_no.global_checkpoint string

    The global checkpoint.

  • warmer.current string

    The number of current warmer operations.

  • warmer.total string

    The total number of warmer operations.

  • warmer.total_time string

    The time spent in warmer operations.

  • path.data string

    The shard data path.

  • path.state string

    The shard state path.

  • bulk.total_operations string

    The number of bulk shard operations.

  • bulk.total_time string

    The time spent in shard bulk operations.

  • bulk.total_size_in_bytes string

    The total size in bytes of shard bulk operations.

  • bulk.avg_time string

    The average time spent in shard bulk operations.

  • bulk.avg_size_in_bytes string

    The average size in bytes of shard bulk operations.

Path parameters

• index string | array[string] Required

  A comma-separated list of data streams, indices, and aliases used to limit the request. Supports wildcards (*). To target all data streams and indices, omit this parameter or use * or _all.

Query parameters

• bytes string

  The unit used to display byte values.

  Values are b, kb, mb, gb, tb, or pb.

• h string | array[string]

  List of columns to appear in the response. Supports simple wildcards.

• s string | array[string]

  List of columns that determine how the table should be sorted. Sorting defaults to ascending and can be changed by setting :asc or :desc as a suffix to the column name.

• master_timeout string

  Period to wait for a connection to the master node.

• time string

  Unit used to display time values.

  Values are nanos, micros, ms, s, m, h, or d.

Responses

• 200 application/json
  Hide response attributes Show response attributes object

  • index string

    The index name.

  • shard string

    The shard name.

  • prirep string

    The shard type: primary or replica.

  • state string

    The shard state. Returned values include: INITIALIZING: The shard is recovering from a peer shard or gateway. RELOCATING: The shard is relocating. STARTED: The shard has started. UNASSIGNED: The shard is not assigned to any node.

  • docs string | null

    The number of documents in the shard.

    One of:

    string-1 string string-2 string | null

  • store string | null

    The disk space used by the shard.

    One of:

    string-1 string string-2 string | null

  • dataset string | null

    total size of dataset (including the cache for partially mounted indices)

    One of:

    string-1 string string-2 string | null

  • ip string | null

    The IP address of the node.

    One of:

    string-1 string string-2 string | null
  • id string

    The unique identifier for the node.

  • node string | null

    The name of node.

    One of:

    string-1 string string-2 string | null
  • sync_id string

    The sync identifier.

  • unassigned.reason string

    The reason for the last change to the state of an unassigned shard. It does not explain why the shard is currently unassigned; use the cluster allocation explain API for that information. Returned values include: ALLOCATION_FAILED: Unassigned as a result of a failed allocation of the shard. CLUSTER_RECOVERED: Unassigned as a result of a full cluster recovery. DANGLING_INDEX_IMPORTED: Unassigned as a result of importing a dangling index. EXISTING_INDEX_RESTORED: Unassigned as a result of restoring into a closed index. FORCED_EMPTY_PRIMARY: The shard’s allocation was last modified by forcing an empty primary using the cluster reroute API. INDEX_CLOSED: Unassigned because the index was closed. INDEX_CREATED: Unassigned as a result of an API creation of an index. INDEX_REOPENED: Unassigned as a result of opening a closed index. MANUAL_ALLOCATION: The shard’s allocation was last modified by the cluster reroute API. NEW_INDEX_RESTORED: Unassigned as a result of restoring into a new index. NODE_LEFT: Unassigned as a result of the node hosting it leaving the cluster. NODE_RESTARTING: Similar to NODE_LEFT, except that the node was registered as restarting using the node shutdown API. PRIMARY_FAILED: The shard was initializing as a replica, but the primary shard failed before the initialization completed. REALLOCATED_REPLICA: A better replica location is identified and causes the existing replica allocation to be cancelled. REINITIALIZED: When a shard moves from started back to initializing. REPLICA_ADDED: Unassigned as a result of explicit addition of a replica. REROUTE_CANCELLED: Unassigned as a result of explicit cancel reroute command.

  • unassigned.at string

    The time at which the shard became unassigned in Coordinated Universal Time (UTC).

  • unassigned.for string

    The time at which the shard was requested to be unassigned in Coordinated Universal Time (UTC).

  • unassigned.details string

    Additional details as to why the shard became unassigned. It does not explain why the shard is not assigned; use the cluster allocation explain API for that information.

  • recoverysource.type string

    The type of recovery source.

  • completion.size string

    The size of completion.

  • fielddata.memory_size string

    The used fielddata cache memory.

  • fielddata.evictions string

    The fielddata cache evictions.

  • query_cache.memory_size string

    The used query cache memory.

  • query_cache.evictions string

    The query cache evictions.

  • flush.total string

    The number of flushes.

  • flush.total_time string

    The time spent in flush.

  • get.current string

    The number of current get operations.

  • get.time string

    The time spent in get operations.

  • get.total string

    The number of get operations.

  • get.exists_time string

    The time spent in successful get operations.

  • get.exists_total string

    The number of successful get operations.

  • get.missing_time string

    The time spent in failed get operations.

  • get.missing_total string

    The number of failed get operations.

  • indexing.delete_current string

    The number of current deletion operations.

  • indexing.delete_time string

    The time spent in deletion operations.

  • indexing.delete_total string

    The number of delete operations.

  • indexing.index_current string

    The number of current indexing operations.

  • indexing.index_time string

    The time spent in indexing operations.

  • indexing.index_total string

    The number of indexing operations.

  • indexing.index_failed string

    The number of failed indexing operations.

  • merges.current string

    The number of current merge operations.

  • merges.current_docs string

    The number of current merging documents.

  • merges.current_size string

    The size of current merge operations.

  • merges.total string

    The number of completed merge operations.

  • merges.total_docs string

    The nuber of merged documents.

  • merges.total_size string

    The size of current merges.

  • merges.total_time string

    The time spent merging documents.

  • refresh.total string

    The total number of refreshes.

  • refresh.time string

    The time spent in refreshes.

  • refresh.external_total string

    The total nunber of external refreshes.

  • refresh.external_time string

    The time spent in external refreshes.

  • refresh.listeners string

    The number of pending refresh listeners.

  • search.fetch_current string

    The current fetch phase operations.

  • search.fetch_time string

    The time spent in fetch phase.

  • search.fetch_total string

    The total number of fetch operations.

  • search.open_contexts string

    The number of open search contexts.

  • search.query_current string

    The current query phase operations.

  • search.query_time string

    The time spent in query phase.

  • search.query_total string

    The total number of query phase operations.

  • search.scroll_current string

    The open scroll contexts.

  • search.scroll_time string

    The time scroll contexts were held open.

  • search.scroll_total string

    The number of completed scroll contexts.

  • segments.count string

    The number of segments.

  • segments.memory string

    The memory used by segments.

  • segments.index_writer_memory string

    The memory used by the index writer.

  • segments.version_map_memory string

    The memory used by the version map.

  • segments.fixed_bitset_memory string

    The memory used by fixed bit sets for nested object field types and export type filters for types referred in _parent fields.

  • seq_no.max string

    The maximum sequence number.

  • seq_no.local_checkpoint string

    The local checkpoint.

  • seq_no.global_checkpoint string

    The global checkpoint.

  • warmer.current string

    The number of current warmer operations.

  • warmer.total string

    The total number of warmer operations.

  • warmer.total_time string

    The time spent in warmer operations.

  • path.data string

    The shard data path.

  • path.state string

    The shard state path.

  • bulk.total_operations string

    The number of bulk shard operations.

  • bulk.total_time string

    The time spent in shard bulk operations.

  • bulk.total_size_in_bytes string

    The total size in bytes of shard bulk operations.

  • bulk.avg_time string

    The average time spent in shard bulk operations.

  • bulk.avg_size_in_bytes string

    The average size in bytes of shard bulk operations.