GET _ml/calendars/[<calendar_id>|_all]

PUT _ml/calendars/<calendar_id>

Create a calendar resource with the given <calendar_id> identifier for associating scheduled event resources later.

DELETE _ml/calendars/<calendar_id>

Remove the calendar resource with the given <calendar_id> identifier and its associated scheduled events.

GET_ml/calendars/[<calendar_id>|

_all]/events

Get all the scheduled events from the calendar resource. An event contains attributes such as description, start_time, end_time, calendar_id, and event_id.

POST_ml/calendars/<calendar_id>/events

Add event resources to a calendar with the given <calendar_id> identifier. Each event resource is specified in the events array in the request body.

DELETE _ml/calendars/<calendar_id>

/events/<event_id>

Remove an event with the given <event_id> identifier from the calendar resource, using the <calendar_id> identifier.

GET _ml/anomaly_detectors/[<job_id>

|<job_id>,<job_id>|_all]

Get the job resource with the given <job_id> identifier, multiple job resources with multiple <job_id> identifiers separated by commas, or all job resources.

DELETE _ml/anomaly_detectors/<job_id>

Delete the job resource with the given <job_id> identifier.

POST_ml/anomaly_detectors/

{job_id}/_open

To open a job means to start receiving new data from where it left off last time and continue the analysis.

POST _ml/anomaly_detectors/[<job_id>|

<job_id>,<job_id>|_all]/_close

This API can close one, multiple, or all job resources. To close a job means to stop receiving data and analysis operations. However, we can still read the job resource.

POST _ml/anomaly_detectors/

<job_id>/_update

Update the properties of the job resource with the <job_id> identifier.

POST_ml/anomaly_detectors/

<job_id>/_data

Send data to a job resource with the <job_id> identifier. The data must be in JSON format in the request body. The job must be opened first.

POST_ml/anomaly_detectors/

<job_id>/_flush

Flush the data to the job resource while data is being sent for analysis. After the flush operation, the job is still opened.

GET _ml/anomaly_detectors/[<job_id>|

<job_id>,<job_id> |_all]/_stats

Get statistics from one, multiple, or all job resources.

POST_ml/anomaly_detectors/

<job_id>/_forecast

Predict the future result of the job with the given <job_id> identifier.

DELETE _ml/anomaly_detectors/<job_id>

/[_forecast|[/<forecast_id>|_all]

Delete the forecast resource with the given <forecast_id> identifier and the job resource with the given <job_id> identifier, or all forecasts.

PUT_ml/calendars/<calendar_id>

/jobs/<job_id>

Add a job resource with the given <job_id> identifier to a calendar resource with the <calendar_id> identifier.

DELETE_ml/calendars/<calendar_id>/

jobs/<job_id>

Delete a job resource with the given <job_id> identifier.

GET _ml/anomaly_detectors/<job_id>

/results/buckets
/[<timestamp>]

Get the bucket aggregation result with the <timestamp> identifier, or get all buckets from the job resource with the <job_id> identifier.

GET _ml/anomaly_detectors/[<job_id>|

<job_id>,<job_id>|

_all]/results/overall_buckets

Provide a summary of bucket aggregation results over multiple jobs where the longest bucket span is used.

GET _ml/anomaly_detectors/<job_id>

/results/records

Get the anomaly records from the results of the job resource with the given <job_id> identifier.

GET _ml/anomaly_detectors/<job_id>

/results/influencers

Get the influencer information from the job resources with the <job_id> identifier.

GET _ml/datafeeds/[<_feed_id>|

<feed_id>,>feed_id>|_all]

Get a datafeed resource with identifiers from one, multiple, or all datafeed resources.

PUT _ml/datafeeds/<feed_id>

Create a datafeed resource for the job resources to use later. The datafeed can be an aggregate or a query.

DELETE _ml/datafeeds/<feed_id>

Delete the datafeed with the given <feed_id> identifier.

POST _ml/datafeeds/<feed_id>/_update

Update the properties of the datafeed with the given <feed_id> identifier.

GET _ml/datafeeds/[<_feed_id>|

<feed_id>,>feed_id>|_all]/stats

Get statistics from one, multiple, or all datafeed resources.

POST _ml/datafeeds/<feed_id>/_start

Start the datafeed and be ready to retrieve data from Elasticsearch.

POST _ml/datafeeds/[<_feed_id>|

<feed_id>,>feed_id>|_all]

/_stop

Stop receiving data for the datafeeds resources in Elasticsearch.

GET _ml/datafeeds/<datafeed_id>/_preview

Preview a datafeed.

GET _ml/filters/[<filter_id>]

Get the filter resource with the given <snapshot_id> identifier or all snapshot resources.

PUT _ml/filters/<filter_id>

A filter defines a list of strings, which is referenced by the detector attribute of the job resources.

POST _ml/filters/<filter_id>/_update

Update the properties of the filter resource.

DELETE _ml/filters/<filter_id>

Delete the filter resource with the given <filter_id> identifier.

GET _ml/anomaly_detectors/<job_id>/

model_snapshots
 /[<snapshot_id>]

Get the snapshot model resource with the <snapshot_id> identifier or all snapshot resources.

POST_ml/anomaly_detectors/<job_id>

/model_snapshots
 /<snapshot_id>/_update

Update the properties of the snapshot model resource with the given <snapshot_id> identifier, and the job resource with the given <job_id> identifier.

DELETE _ml/anomaly_detectors/<job_id>/

model_snapshots
/<snapshot_id>

Delete the snapshot model resource with the given <snapshot_id> identifier.

POST _ml/anomaly_detectors/<job_id>/

model_snapshots
/<snapshot_id>/_revert

Reset the state of the snapshot model with the given <snapshot_id> identifier, of the job resource with the given <job_id> identifier, to the previous record.

API URL

Description

DELETE_ml/_deleted_expired_data

Deletes all resources, data, and results if they are expired.

POST _ml/find_file_structure

Finds the file structure of a file. The data of the file must be suitable for Ingest APIs.

POST _ml/set_upgrade_mode

If the enabled parameter is set to true, it enables the upgrade_mode setting to prepare the indices used by machine learning for an upgrade.