IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elasticsearch Guide [7.6] ›REST APIs ›Machine learning anomaly detection APIs
« Get machine learning info API Get overall buckets API »

Get model snapshots APIedit

Retrieves information about model snapshots.

Requestedit

GET _ml/anomaly_detectors/<job_id>/model_snapshots

GET _ml/anomaly_detectors/<job_id>/model_snapshots/<snapshot_id>

Prerequisitesedit

  • If the Elasticsearch security features are enabled, you must have monitor_ml, monitor, manage_ml, or manage cluster privileges to use this API. See Security privileges.

Path parametersedit

<job_id>
(Required, string) Identifier for the anomaly detection job.
<snapshot_id>

(Optional, string) A numerical character string that uniquely identifies the model snapshot.

If you do not specify this optional parameter, the API returns information about all model snapshots.

Request bodyedit

desc
(Optional, boolean) If true, the results are sorted in descending order.
end
(Optional, date) Returns snapshots with timestamps earlier than this time.
from
(Optional, integer) Skips the specified number of snapshots.
size
(Optional, integer) Specifies the maximum number of snapshots to obtain.
sort
(Optional, string) Specifies the sort field for the requested snapshots. By default, the snapshots are sorted by their timestamp.
start
(Optional, string) Returns snapshots with timestamps after this time.

Response bodyedit

The API returns an array of model snapshot objects, which have the following properties:

description
(string) An optional description of the job.
job_id
(string) A numerical character string that uniquely identifies the job that the snapshot was created for.
latest_record_time_stamp
(date) The timestamp of the latest processed record.
latest_result_time_stamp
(date) The timestamp of the latest bucket result.
min_version
(string) The minimum version required to be able to restore the model snapshot.
model_size_stats

(object) Summary information describing the model.

model_size_stats.bucket_allocation_failures_count
(long) The number of buckets for which entities were not processed due to memory limit constraints.
model_size_stats.job_id
(string) Identifier for the anomaly detection job.
model_size_stats.log_time
(date) The timestamp that the model_size_stats were recorded, according to server-time.
model_size_stats.memory_status

(string) The status of the memory in relation to its model_memory_limit. Contains one of the following values.

  • hard_limit: The internal models require more space that the configured memory limit. Some incoming data could not be processed.
  • ok: The internal models stayed below the configured value.
  • soft_limit: The internal models require more than 60% of the configured memory limit and more aggressive pruning will be performed in order to try to reclaim space.
model_size_stats.model_bytes
(long) An approximation of the memory resources required for this analysis.
model_size_stats.model_bytes_exceeded
(long) The number of bytes over the high limit for memory usage at the last allocation failure.
model_size_stats.model_bytes_memory_limit
(long) The upper limit for memory usage, checked on increasing values.
model_size_stats.result_type
(string) Internal. This value is always set to model_size_stats.
model_size_stats.timestamp
(date) The timestamp that the model_size_stats were recorded, according to the bucket timestamp of the data.
model_size_stats.total_by_field_count
(long) The number of by field values analyzed. Note that these are counted separately for each detector and partition.
model_size_stats.total_over_field_count
(long) The number of over field values analyzed. Note that these are counted separately for each detector and partition.
model_size_stats.total_partition_field_count
(long) The number of partition field values analyzed.
retain
(boolean) If true, this snapshot will not be deleted during automatic cleanup of snapshots older than model_snapshot_retention_days. However, this snapshot will be deleted when the job is deleted. The default value is false.
snapshot_id
(string) A numerical character string that uniquely identifies the model snapshot.
snapshot_doc_count
(long) For internal use only.
timestamp
(date) The creation timestamp for the snapshot.

Examplesedit

GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots
{
  "start": "1575402236000"
}

In this example, the API provides a single result:

{
  "count" : 1,
  "model_snapshots" : [
    {
      "job_id" : "high_sum_total_sales",
      "min_version" : "6.4.0",
      "timestamp" : 1575402237000,
      "description" : "State persisted due to job close at 2019-12-03T19:43:57+0000",
      "snapshot_id" : "1575402237",
      "snapshot_doc_count" : 1,
      "model_size_stats" : {
        "job_id" : "high_sum_total_sales",
        "result_type" : "model_size_stats",
        "model_bytes" : 1638816,
        "model_bytes_exceeded" : 0,
        "model_bytes_memory_limit" : 10485760,
        "total_by_field_count" : 3,
        "total_over_field_count" : 3320,
        "total_partition_field_count" : 2,
        "bucket_allocation_failures_count" : 0,
        "memory_status" : "ok",
        "log_time" : 1575402237000,
        "timestamp" : 1576965600000
      },
      "latest_record_time_stamp" : 1576971072000,
      "latest_result_time_stamp" : 1576965600000,
      "retain" : false
    }
  ]
}
« Get machine learning info API Get overall buckets API »