Forecast jobs APIedit

Predicts the future behavior of a time series by using its historical behavior.


POST _ml/anomaly_detectors/<job_id>/_forecast


  • If the Elasticsearch security features are enabled, you must have manage_ml or manage cluster privileges to use this API. See Security privileges.


See Forecasting the future.

  • If you use an over_field_name property in your job, you cannot create a forecast. For more information about this property, see Job resources.
  • The job must be open when you create a forecast. Otherwise, an error occurs.

Path parametersedit

(Required, string) Identifier for the job.

Request bodyedit

(Optional, time units) A period of time that indicates how far into the future to forecast. For example, 30d corresponds to 30 days. The default value is 1 day. The forecast starts at the last record that was processed.
(Optional, time units) The period of time that forecast results are retained. After a forecast expires, the results are deleted. The default value is 14 days. If set to a value of 0, the forecast is never automatically deleted.


The following example requests a 10 day forecast for the total-requests job:

POST _ml/anomaly_detectors/total-requests/_forecast
  "duration": "10d"

When the forecast is created, you receive the following results:

  "acknowledged": true,
  "forecast_id": "wkCWa2IB2lF8nSE_TzZo"

You can subsequently see the forecast in the Single Metric Viewer in Kibana.