Create a filter Generally available; Added in 5.4.0

PUT /_ml/filters/{filter_id}

A filter contains a list of strings. It can be used by one or more anomaly detection jobs. Specifically, filters are referenced in the custom_rules property of detector configuration objects. ##Required authorization

  • Cluster privileges: manage_ml

Path parameters

  • filter_id string Required

    A string that uniquely identifies a filter.

application/json

Body Required

  • description string

    A description of the filter.

  • items array[string]

    The items of the filter. A wildcard * can be used at the beginning or the end of an item. Up to 10000 items are allowed in each filter.

Responses

  • 200 application/json
    Hide response attributes Show response attributes object
    • description string Required
    • filter_id string Required
    • items array[string] Required
PUT /_ml/filters/{filter_id} 
PUT _ml/filters/safe_domains
{
  "description": "A list of safe domains",
  "items": ["*.google.com", "wikipedia.org"]
}
curl \
 --request PUT 'http://api.example.com/_ml/filters/{filter_id}' \
 --header "Content-Type: application/json" \
 --data '"{\n  \"description\": \"A list of safe domains\",\n  \"items\": [\"*.google.com\", \"wikipedia.org\"]\n}"'
Request example
An example body for a `PUT _ml/filters/safe_domains` request. 
{
  "description": "A list of safe domains",
  "items": ["*.google.com", "wikipedia.org"]
}

Documentation preview

This is a preview of your version @2025-06-09 which is not yet released.

View current documentation