Delete anomaly detection jobs APIedit

Deletes an existing anomaly detection job.


DELETE _ml/anomaly_detectors/<job_id>


  • Requires the manage_ml cluster privilege. This privilege is included in the machine_learning_admin built-in role.
  • Before you can delete a job, you must close it (unless you specify the force parameter). See Close jobs.


All job configuration, model state and results are deleted.

Deleting an anomaly detection job must be done via this API only. Do not delete the job directly from the .ml-* indices using the Elasticsearch delete document API. When Elasticsearch security features are enabled, make sure no write privileges are granted to anyone over the .ml-* indices.

It is not currently possible to delete multiple jobs using wildcards or a comma separated list.

If you delete a job that has a datafeed, the request first tries to delete the datafeed. This behavior is equivalent to calling delete datafeed with the same timeout and force parameters as the delete job request.

Path parametersedit

(Required, string) Identifier for the anomaly detection job.

Query parametersedit

(Optional, Boolean) Use to forcefully delete an opened job; this method is quicker than closing and deleting the job.
(Optional, Boolean) Specifies whether the request should return immediately or wait until the job deletion completes. Defaults to true.
(Optional, Boolean) Specifies whether annotations that have been added by the user should be deleted along with any auto-generated annotations when the job is reset. Defaults to false.


response =
  job_id: 'total-requests'
puts response
DELETE _ml/anomaly_detectors/total-requests

When the job is deleted, you receive the following results:

  "acknowledged": true

In the next example we delete the total-requests job asynchronously:

response =
  job_id: 'total-requests',
  wait_for_completion: false
puts response
DELETE _ml/anomaly_detectors/total-requests?wait_for_completion=false

When wait_for_completion is set to false, the response contains the id of the job deletion task:

  "task": "oTUltX4IQMOUUVeiohTt8A:39"