openapi: 3.2.0 info: title: Elasticsearch ml anomaly API description: 'Elasticsearch provides REST APIs that are used by the UI components and can be called directly to configure and access Elasticsearch features. ## Documentation source and versions This documentation is derived from the main branch of the elasticsearch-specification repository. It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International. This documentation contains work-in-progress information for future Elastic Stack releases.' license: name: Apache 2.0 url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE version: '' security: - apiKeyAuth: [] - basicAuth: [] - bearerAuth: [] tags: - name: ml anomaly description: The machine learning anomaly detection APIs enable you to perform anomaly detection activities. externalDocs: description: Learn more. url: https://www.elastic.co/docs/explore-analyze/machine-learning/anomaly-detection/ml-ad-finding-anomalies x-displayName: Machine learning anomaly detection paths: /_ml/anomaly_detectors/{job_id}/_close: post: tags: - ml anomaly summary: Close anomaly detection jobs description: 'A job can be opened and closed multiple times throughout its lifecycle. A closed job cannot receive data or perform analysis operations, but you can still explore and navigate results. When you close a job, it runs housekeeping tasks such as pruning the model history, flushing buffers, calculating final results and persisting the model snapshots. Depending upon the size of the job, it could take several minutes to close and the equivalent time to re-open. After it is closed, the job has a minimal overhead on the cluster except for maintaining its meta data. Therefore it is a best practice to close jobs that are no longer required to process data. If you close an anomaly detection job whose datafeed is running, the request first tries to stop the datafeed. This behavior is equivalent to calling stop datafeed API with the same timeout and force parameters as the close job request. When a datafeed that has a specified end date stops, it automatically closes its associated job.' operationId: ml-close-job parameters: - in: path name: job_id description: Identifier for the anomaly detection job. It can be a job identifier, a group name, or a wildcard expression. You can close multiple anomaly detection jobs in a single API request by using a group name, a comma-separated list of jobs, or a wildcard expression. You can close all jobs by using `_all` or by specifying `*` as the job identifier. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: contains wildcard expressions and there are no jobs that match; contains the `_all` string or no identifiers and there are no matches; or contains wildcard expressions and there are only partial matches. By default, it returns an empty jobs array when there are no matches and the subset of results when there are partial matches. If `false`, the request returns a 404 status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: force description: 'Use to close a failed job, or to forcefully close a job which has not responded to its initial close request; the request returns without performing the associated actions such as flushing buffers and persisting the model snapshots. If you want the job to be in a consistent state after the close job API returns, do not set to `true`. This parameter should be used only in situations where the job has already failed or where you are not interested in results the job might have recently produced or might produce in the future.' deprecated: false schema: type: boolean style: form - in: query name: timeout description: Controls the time to wait until a job has closed. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: allow_no_match: description: Refer to the description for the `allow_no_match` query parameter. default: true type: boolean force: description: Refer to the descriptiion for the `force` query parameter. default: false type: boolean timeout: description: Refer to the description for the `timeout` query parameter. default: 30m allOf: - $ref: '#/components/schemas/_types.Duration' responses: '200': description: '' content: application/json: schema: type: object properties: closed: type: boolean required: - closed examples: MlCloseJobResponseExample1: description: A successful response when closing anomaly detection jobs. value: "{\n \"closed\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_close\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: close_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'POST _ml/anomaly_detectors/low_request_rate/_close ' - lang: Python source: "resp = client.ml.close_job(\n job_id=\"low_request_rate\",\n)" - lang: JavaScript source: "const response = await client.ml.closeJob({\n job_id: \"low_request_rate\",\n});" - lang: Ruby source: "response = client.ml.close_job(\n job_id: \"low_request_rate\"\n)" - lang: PHP source: "$resp = $client->ml()->closeJob([\n \"job_id\" => \"low_request_rate\",\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_close"' - lang: Java source: "client.ml().closeJob(c -> c\n .jobId(\"low_request_rate\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/calendars/{calendar_id}: get: tags: - ml anomaly summary: Get calendar configuration info operationId: ml-get-calendars-2 parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. You can get information for multiple calendars by using a comma-separated list of ids or a wildcard expression. You can get information for all calendars by using `_all` or `*` or by omitting the calendar identifier. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: from description: Skips the specified number of calendars. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of calendars to obtain. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: This object is supported only when you omit the calendar identifier. allOf: - $ref: '#/components/schemas/ml._types.Page' responses: '200': description: '' content: application/json: schema: type: object properties: calendars: type: array items: $ref: '#/components/schemas/ml.get_calendars.Calendar' count: type: number required: - calendars - count x-state: Generally available; Added in 6.2.0 x-variations: - "
\n GET\n /_ml/calendars/{calendar_id}\n
\n " - "
\n POST\n /_ml/calendars/{calendar_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_calendars.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.get_calendars(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.getCalendars({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.get_calendars(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->getCalendars([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().getCalendars(g -> g\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name put: tags: - ml anomaly summary: Create a calendar operationId: ml-put-calendar parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: job_ids: description: An array of anomaly detection job identifiers. type: array items: $ref: '#/components/schemas/_types.Id' description: description: A description of the calendar. type: string responses: '200': description: '' content: application/json: schema: type: object properties: calendar_id: description: A string that uniquely identifies a calendar. allOf: - $ref: '#/components/schemas/_types.Id' description: description: A description of the calendar. type: string job_ids: description: A list of anomaly detection job identifiers or group names. allOf: - $ref: '#/components/schemas/_types.Ids' required: - calendar_id - job_ids x-state: Generally available; Added in 6.2.0 x-variations: - "
\n PUT\n /_ml/calendars/{calendar_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: put_calendar.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'PUT _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.put_calendar(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.putCalendar({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.put_calendar(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->putCalendar([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().putCalendar(p -> p\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get calendar configuration info operationId: ml-get-calendars-3 parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. You can get information for multiple calendars by using a comma-separated list of ids or a wildcard expression. You can get information for all calendars by using `_all` or `*` or by omitting the calendar identifier. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: from description: Skips the specified number of calendars. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of calendars to obtain. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: This object is supported only when you omit the calendar identifier. allOf: - $ref: '#/components/schemas/ml._types.Page' responses: '200': description: '' content: application/json: schema: type: object properties: calendars: type: array items: $ref: '#/components/schemas/ml.get_calendars.Calendar' count: type: number required: - calendars - count x-state: Generally available; Added in 6.2.0 x-variations: - "
\n GET\n /_ml/calendars/{calendar_id}\n
\n " - "
\n POST\n /_ml/calendars/{calendar_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_calendars.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.get_calendars(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.getCalendars({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.get_calendars(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->getCalendars([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().getCalendars(g -> g\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete a calendar description: Remove all scheduled events from a calendar, then delete it. operationId: ml-delete-calendar parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteCalendarResponseExample1: description: A successful response when deleting a calendar. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 6.2.0 x-variations: - "
\n DELETE\n /_ml/calendars/{calendar_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_calendar.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.delete_calendar(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteCalendar({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.delete_calendar(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteCalendar([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().deleteCalendar(d -> d\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/calendars/{calendar_id}/events/{event_id}: delete: tags: - ml anomaly summary: Delete events from a calendar operationId: ml-delete-calendar-event parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: event_id description: 'Identifier for the scheduled event. You can obtain this identifier by using the get calendar events API.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteCalendarEventResponseExample1: description: A successful response when deleting a calendar event. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 6.2.0 x-variations: - "
\n DELETE\n /_ml/calendars/{calendar_id}/events/{event_id}\n
\n " x-api: delete_calendar_event.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/calendars/planned-outages/events/LS8LJGEBMTCMA-qz49st ' - lang: Python source: "resp = client.ml.delete_calendar_event(\n calendar_id=\"planned-outages\",\n event_id=\"LS8LJGEBMTCMA-qz49st\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteCalendarEvent({\n calendar_id: \"planned-outages\",\n event_id: \"LS8LJGEBMTCMA-qz49st\",\n});" - lang: Ruby source: "response = client.ml.delete_calendar_event(\n calendar_id: \"planned-outages\",\n event_id: \"LS8LJGEBMTCMA-qz49st\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteCalendarEvent([\n \"calendar_id\" => \"planned-outages\",\n \"event_id\" => \"LS8LJGEBMTCMA-qz49st\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages/events/LS8LJGEBMTCMA-qz49st"' - lang: Java source: "client.ml().deleteCalendarEvent(d -> d\n .calendarId(\"planned-outages\")\n .eventId(\"LS8LJGEBMTCMA-qz49st\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/calendars/{calendar_id}/jobs/{job_id}: put: tags: - ml anomaly summary: Add anomaly detection job to calendar operationId: ml-put-calendar-job parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: job_id description: An identifier for the anomaly detection jobs. It can be a job identifier, a group name, or a comma-separated list of jobs or groups. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: calendar_id: description: A string that uniquely identifies a calendar. allOf: - $ref: '#/components/schemas/_types.Id' description: description: A description of the calendar. type: string job_ids: description: A list of anomaly detection job identifiers or group names. allOf: - $ref: '#/components/schemas/_types.Ids' required: - calendar_id - job_ids x-state: Generally available; Added in 6.2.0 x-variations: - "
\n PUT\n /_ml/calendars/{calendar_id}/jobs/{job_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: put_calendar_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'PUT _ml/calendars/planned-outages/jobs/total-requests ' - lang: Python source: "resp = client.ml.put_calendar_job(\n calendar_id=\"planned-outages\",\n job_id=\"total-requests\",\n)" - lang: JavaScript source: "const response = await client.ml.putCalendarJob({\n calendar_id: \"planned-outages\",\n job_id: \"total-requests\",\n});" - lang: Ruby source: "response = client.ml.put_calendar_job(\n calendar_id: \"planned-outages\",\n job_id: \"total-requests\"\n)" - lang: PHP source: "$resp = $client->ml()->putCalendarJob([\n \"calendar_id\" => \"planned-outages\",\n \"job_id\" => \"total-requests\",\n]);" - lang: curl source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages/jobs/total-requests"' - lang: Java source: "client.ml().putCalendarJob(p -> p\n .calendarId(\"planned-outages\")\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete anomaly jobs from a calendar operationId: ml-delete-calendar-job parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: job_id description: 'An identifier for the anomaly detection jobs. It can be a job identifier, a group name, or a comma-separated list of jobs or groups.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple responses: '200': description: '' content: application/json: schema: type: object properties: calendar_id: description: A string that uniquely identifies a calendar. allOf: - $ref: '#/components/schemas/_types.Id' description: description: A description of the calendar. type: string job_ids: description: A list of anomaly detection job identifiers or group names. allOf: - $ref: '#/components/schemas/_types.Ids' required: - calendar_id - job_ids examples: MlDeleteCalendarJobResponseExample1: description: A successful response when deleting an anomaly detection job from a calendar. value: "{\n \"calendar_id\": \"planned-outages\",\n \"job_ids\": []\n}" x-state: Generally available; Added in 6.2.0 x-variations: - "
\n DELETE\n /_ml/calendars/{calendar_id}/jobs/{job_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_calendar_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/calendars/planned-outages/jobs/total-requests ' - lang: Python source: "resp = client.ml.delete_calendar_job(\n calendar_id=\"planned-outages\",\n job_id=\"total-requests\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteCalendarJob({\n calendar_id: \"planned-outages\",\n job_id: \"total-requests\",\n});" - lang: Ruby source: "response = client.ml.delete_calendar_job(\n calendar_id: \"planned-outages\",\n job_id: \"total-requests\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteCalendarJob([\n \"calendar_id\" => \"planned-outages\",\n \"job_id\" => \"total-requests\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages/jobs/total-requests"' - lang: Java source: "client.ml().deleteCalendarJob(d -> d\n .calendarId(\"planned-outages\")\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}: get: tags: - ml anomaly summary: Get datafeeds configuration info description: 'You can get information for multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can get information for all datafeeds by using `_all`, by specifying `*` as the ``, or by omitting the ``. This API returns a maximum of 10,000 datafeeds.' operationId: ml-get-datafeeds parameters: - in: path name: datafeed_id description: 'Identifier for the datafeed. It can be a datafeed identifier or a wildcard expression. If you do not specify one of these options, the API returns information about all datafeeds.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no datafeeds that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `datafeeds` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: exclude_generated description: 'Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number datafeeds: type: array items: $ref: '#/components/schemas/ml._types.Datafeed' required: - count - datafeeds x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/datafeeds/{datafeed_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_datafeeds.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales ' - lang: Python source: "resp = client.ml.get_datafeeds(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getDatafeeds({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_datafeeds(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getDatafeeds([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales"' - lang: Java source: "client.ml().getDatafeeds(g -> g\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name put: tags: - ml anomaly summary: Create a datafeed description: 'Datafeeds retrieve data from Elasticsearch for analysis by an anomaly detection job. You can associate only one datafeed with each anomaly detection job. The datafeed contains a query that runs at a defined interval (`frequency`). If you are concerned about delayed data, you can add a delay (`query_delay'') at each interval. By default, the datafeed uses the following query: `{"match_all": {"boost": 1}}`. When Elasticsearch security features are enabled, your datafeed remembers which roles the user who created it had at the time of creation and runs the query using those same roles. If you provide secondary authorization headers, those credentials are used instead. You must use Kibana, this API, or the create anomaly detection jobs API to create a datafeed. Do not add a datafeed directly to the `.ml-config` index. Do not give users `write` privileges on the `.ml-config` index.' operationId: ml-put-datafeed parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_indices description: 'If true, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the `_all` string or when no indices are specified.' deprecated: false schema: type: boolean style: form - in: query name: expand_wildcards description: "Type of index that wildcard patterns can match. If the request can target data streams, this argument determines\nwhether wildcard expressions match hidden data streams. Supports comma-separated values.\n\nSupported values include:\n - `all`: Match any data stream or index, including hidden ones.\n - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream.\n - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.\n - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`.\n - `none`: Wildcard expressions are not accepted.\n\n" deprecated: false schema: $ref: '#/components/schemas/_types.ExpandWildcards' style: form - in: query name: ignore_throttled description: If true, concrete, expanded, or aliased indices are ignored when frozen. deprecated: true schema: type: boolean style: form - in: query name: ignore_unavailable description: If true, unavailable indices (missing or closed) are ignored. deprecated: false schema: type: boolean style: form requestBody: content: application/json: schema: type: object properties: aggregations: description: 'If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data.' type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' chunking_config: description: 'Datafeeds might be required to search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.' allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' delayed_data_check_config: description: 'Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the `query_delay` is set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds.' allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' frequency: description: 'The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When `frequency` is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.' allOf: - $ref: '#/components/schemas/_types.Duration' indices: description: 'An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the master nodes and the machine learning nodes must have the `remote_cluster_client` role.' allOf: - $ref: '#/components/schemas/_types.Indices' indices_options: description: Specifies index expansion options that are used during search allOf: - $ref: '#/components/schemas/_types.IndicesOptions' job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' max_empty_searches: description: 'If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after `frequency` times `max_empty_searches` of real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. By default, it is not set.' type: number query: description: 'The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch.' default: '{"match_all": {"boost": 1}}' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: description: 'The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between `60s` and `120s`. This randomness improves the query performance when there are multiple jobs running on the same node.' allOf: - $ref: '#/components/schemas/_types.Duration' runtime_mappings: description: Specifies runtime fields for the datafeed search. allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' script_fields: description: 'Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields.' type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: description: 'The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of `index.max_result_window`, which is 10,000 by default.' default: 1000.0 type: number headers: x-state: Generally available; Added in 8.0.0 allOf: - $ref: '#/components/schemas/_types.HttpHeaders' examples: MlPutDatafeedExample1: description: An example body for a `PUT _ml/datafeeds/datafeed-test-job?pretty` request. value: "{\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"job_id\": \"test-job\"\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: aggregations: type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' authorization: allOf: - $ref: '#/components/schemas/ml._types.DatafeedAuthorization' chunking_config: allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' delayed_data_check_config: allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' datafeed_id: allOf: - $ref: '#/components/schemas/_types.Id' frequency: allOf: - $ref: '#/components/schemas/_types.Duration' indices: type: array items: type: string job_id: allOf: - $ref: '#/components/schemas/_types.Id' indices_options: allOf: - $ref: '#/components/schemas/_types.IndicesOptions' max_empty_searches: type: number query: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: allOf: - $ref: '#/components/schemas/_types.Duration' runtime_mappings: allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' script_fields: type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: type: number required: - chunking_config - datafeed_id - indices - job_id - query - query_delay - scroll_size x-state: Generally available; Added in 5.4.0 x-variations: - "
\n PUT\n /_ml/datafeeds/{datafeed_id}\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: put_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: "PUT _ml/datafeeds/datafeed-test-job?pretty\n{\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"job_id\": \"test-job\"\n}" - lang: Python source: "resp = client.ml.put_datafeed(\n datafeed_id=\"datafeed-test-job\",\n pretty=True,\n indices=[\n \"kibana_sample_data_logs\"\n ],\n query={\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n job_id=\"test-job\",\n)" - lang: JavaScript source: "const response = await client.ml.putDatafeed({\n datafeed_id: \"datafeed-test-job\",\n pretty: \"true\",\n indices: [\"kibana_sample_data_logs\"],\n query: {\n bool: {\n must: [\n {\n match_all: {},\n },\n ],\n },\n },\n job_id: \"test-job\",\n});" - lang: Ruby source: "response = client.ml.put_datafeed(\n datafeed_id: \"datafeed-test-job\",\n pretty: \"true\",\n body: {\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"job_id\": \"test-job\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->putDatafeed([\n \"datafeed_id\" => \"datafeed-test-job\",\n \"pretty\" => \"true\",\n \"body\" => [\n \"indices\" => array(\n \"kibana_sample_data_logs\",\n ),\n \"query\" => [\n \"bool\" => [\n \"must\" => array(\n [\n \"match_all\" => new ArrayObject([]),\n ],\n ),\n ],\n ],\n \"job_id\" => \"test-job\",\n ],\n]);" - lang: curl source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"indices":["kibana_sample_data_logs"],"query":{"bool":{"must":[{"match_all":{}}]}},"job_id":"test-job"}'' "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-test-job?pretty"' - lang: Java source: "client.ml().putDatafeed(p -> p\n .datafeedId(\"datafeed-test-job\")\n .indices(\"kibana_sample_data_logs\")\n .jobId(\"test-job\")\n .query(q -> q\n .bool(b -> b\n .must(m -> m\n .matchAll(ma -> ma)\n )\n )\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete a datafeed operationId: ml-delete-datafeed parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: force description: 'Use to forcefully delete a started datafeed; this method is quicker than stopping and deleting the datafeed.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteDatafeedResponseExample1: description: A successful response when deleting a datafeed. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/datafeeds/{datafeed_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/datafeeds/datafeed-total-requests ' - lang: Python source: "resp = client.ml.delete_datafeed(\n datafeed_id=\"datafeed-total-requests\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteDatafeed({\n datafeed_id: \"datafeed-total-requests\",\n});" - lang: Ruby source: "response = client.ml.delete_datafeed(\n datafeed_id: \"datafeed-total-requests\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteDatafeed([\n \"datafeed_id\" => \"datafeed-total-requests\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-total-requests"' - lang: Java source: "client.ml().deleteDatafeed(d -> d\n .datafeedId(\"datafeed-total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/_delete_expired_data/{job_id}: delete: tags: - ml anomaly summary: Delete expired ML data description: 'Delete all job results, model snapshots and forecast data that have exceeded their retention days period. Machine learning state documents that are not associated with any job are also deleted. You can limit the request to a single or set of anomaly detection jobs by using a job identifier, a group name, a comma-separated list of jobs, or a wildcard expression. You can delete expired data for all anomaly detection jobs by using `_all`, by specifying `*` as the ``, or by omitting the ``.' operationId: ml-delete-expired-data parameters: - in: path name: job_id description: 'Identifier for an anomaly detection job. It can be a job identifier, a group name, or a wildcard expression.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: requests_per_second description: 'The desired requests per second for the deletion processes. The default behavior is no throttling.' deprecated: false schema: type: number style: form - in: query name: timeout description: How long can the underlying delete processes run until they are canceled. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: requests_per_second: description: 'The desired requests per second for the deletion processes. The default behavior is no throttling.' type: number timeout: description: How long can the underlying delete processes run until they are canceled. default: 8h allOf: - $ref: '#/components/schemas/_types.Duration' responses: '200': description: '' content: application/json: schema: type: object properties: deleted: type: boolean required: - deleted examples: MlDeleteExpiredDataResponseExample1: description: A successful response when deleting expired and unused anomaly detection data. value: "{\n \"deleted\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/_delete_expired_data/{job_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_expired_data.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/_delete_expired_data?timeout=1h ' - lang: Python source: "resp = client.ml.delete_expired_data(\n timeout=\"1h\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteExpiredData({\n timeout: \"1h\",\n});" - lang: Ruby source: "response = client.ml.delete_expired_data(\n timeout: \"1h\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteExpiredData([\n \"timeout\" => \"1h\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/_delete_expired_data?timeout=1h"' - lang: Java source: "client.ml().deleteExpiredData(d -> d\n .timeout(t -> t\n .offset(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/_delete_expired_data: delete: tags: - ml anomaly summary: Delete expired ML data description: 'Delete all job results, model snapshots and forecast data that have exceeded their retention days period. Machine learning state documents that are not associated with any job are also deleted. You can limit the request to a single or set of anomaly detection jobs by using a job identifier, a group name, a comma-separated list of jobs, or a wildcard expression. You can delete expired data for all anomaly detection jobs by using `_all`, by specifying `*` as the ``, or by omitting the ``.' operationId: ml-delete-expired-data-1 parameters: - in: query name: requests_per_second description: 'The desired requests per second for the deletion processes. The default behavior is no throttling.' deprecated: false schema: type: number style: form - in: query name: timeout description: How long can the underlying delete processes run until they are canceled. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: requests_per_second: description: 'The desired requests per second for the deletion processes. The default behavior is no throttling.' type: number timeout: description: How long can the underlying delete processes run until they are canceled. default: 8h allOf: - $ref: '#/components/schemas/_types.Duration' responses: '200': description: '' content: application/json: schema: type: object properties: deleted: type: boolean required: - deleted examples: MlDeleteExpiredDataResponseExample1: description: A successful response when deleting expired and unused anomaly detection data. value: "{\n \"deleted\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/_delete_expired_data\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_expired_data.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/_delete_expired_data?timeout=1h ' - lang: Python source: "resp = client.ml.delete_expired_data(\n timeout=\"1h\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteExpiredData({\n timeout: \"1h\",\n});" - lang: Ruby source: "response = client.ml.delete_expired_data(\n timeout: \"1h\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteExpiredData([\n \"timeout\" => \"1h\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/_delete_expired_data?timeout=1h"' - lang: Java source: "client.ml().deleteExpiredData(d -> d\n .timeout(t -> t\n .offset(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/filters/{filter_id}: get: tags: - ml anomaly summary: Get filters description: You can get a single filter or all filters. operationId: ml-get-filters-1 parameters: - in: path name: filter_id description: A string that uniquely identifies a filter. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple - in: query name: from description: Skips the specified number of filters. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of filters to obtain. deprecated: false schema: type: number style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number filters: type: array items: $ref: '#/components/schemas/ml._types.Filter' required: - count - filters x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/filters/{filter_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: get_filters.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/filters/safe_domains ' - lang: Python source: "resp = client.ml.get_filters(\n filter_id=\"safe_domains\",\n)" - lang: JavaScript source: "const response = await client.ml.getFilters({\n filter_id: \"safe_domains\",\n});" - lang: Ruby source: "response = client.ml.get_filters(\n filter_id: \"safe_domains\"\n)" - lang: PHP source: "$resp = $client->ml()->getFilters([\n \"filter_id\" => \"safe_domains\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/filters/safe_domains"' - lang: Java source: "client.ml().getFilters(g -> g\n .filterId(\"safe_domains\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name put: tags: - ml anomaly summary: Create a filter description: 'A filter contains a list of strings. It can be used by one or more anomaly detection jobs. Specifically, filters are referenced in the `custom_rules` property of detector configuration objects.' operationId: ml-put-filter parameters: - in: path name: filter_id description: A string that uniquely identifies a filter. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: description: description: A description of the filter. type: string items: description: 'The items of the filter. A wildcard `*` can be used at the beginning or the end of an item. Up to 10000 items are allowed in each filter.' type: array items: type: string examples: MlPutFilterExample1: description: An example body for a `PUT _ml/filters/safe_domains` request. value: "{\n \"description\": \"A list of safe domains\",\n \"items\": [\"*.google.com\", \"wikipedia.org\"]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: description: type: string filter_id: allOf: - $ref: '#/components/schemas/_types.Id' items: type: array items: type: string required: - description - filter_id - items x-state: Generally available; Added in 5.4.0 x-variations: - "
\n PUT\n /_ml/filters/{filter_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: put_filter.ml x-category: ai/ml x-codeSamples: - lang: Console source: "PUT _ml/filters/safe_domains\n{\n \"description\": \"A list of safe domains\",\n \"items\": [\"*.google.com\", \"wikipedia.org\"]\n}" - lang: Python source: "resp = client.ml.put_filter(\n filter_id=\"safe_domains\",\n description=\"A list of safe domains\",\n items=[\n \"*.google.com\",\n \"wikipedia.org\"\n ],\n)" - lang: JavaScript source: "const response = await client.ml.putFilter({\n filter_id: \"safe_domains\",\n description: \"A list of safe domains\",\n items: [\"*.google.com\", \"wikipedia.org\"],\n});" - lang: Ruby source: "response = client.ml.put_filter(\n filter_id: \"safe_domains\",\n body: {\n \"description\": \"A list of safe domains\",\n \"items\": [\n \"*.google.com\",\n \"wikipedia.org\"\n ]\n }\n)" - lang: PHP source: "$resp = $client->ml()->putFilter([\n \"filter_id\" => \"safe_domains\",\n \"body\" => [\n \"description\" => \"A list of safe domains\",\n \"items\" => array(\n \"*.google.com\",\n \"wikipedia.org\",\n ),\n ],\n]);" - lang: curl source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"A list of safe domains","items":["*.google.com","wikipedia.org"]}'' "$ELASTICSEARCH_URL/_ml/filters/safe_domains"' - lang: Java source: "client.ml().putFilter(p -> p\n .description(\"A list of safe domains\")\n .filterId(\"safe_domains\")\n .items(List.of(\"*.google.com\",\"wikipedia.org\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete a filter description: 'If an anomaly detection job references the filter, you cannot delete the filter. You must update or delete the job before you can delete the filter.' operationId: ml-delete-filter parameters: - in: path name: filter_id description: A string that uniquely identifies a filter. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteFilterResponseExample1: description: A successful response when deleting a filter. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/filters/{filter_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_filter.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/filters/safe_domains ' - lang: Python source: "resp = client.ml.delete_filter(\n filter_id=\"safe_domains\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteFilter({\n filter_id: \"safe_domains\",\n});" - lang: Ruby source: "response = client.ml.delete_filter(\n filter_id: \"safe_domains\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteFilter([\n \"filter_id\" => \"safe_domains\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/filters/safe_domains"' - lang: Java source: "client.ml().deleteFilter(d -> d\n .filterId(\"safe_domains\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_forecast: post: tags: - ml anomaly summary: Predict future behavior of a time series description: 'Forecasts are not supported for jobs that perform population analysis; an error occurs if you try to create a forecast for a job that has an `over_field_name` in its configuration. Forcasts predict future behavior based on historical data.' operationId: ml-forecast parameters: - in: path name: job_id description: 'Identifier for the anomaly detection job. The job must be open when you create a forecast; otherwise, an error occurs.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: duration description: 'A period of time that indicates how far into the future to forecast. For example, `30d` corresponds to 30 days. The forecast starts at the last record that was processed.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form - in: query name: expires_in description: 'The period of time that forecast results are retained. After a forecast expires, the results are deleted. If set to a value of 0, the forecast is never automatically deleted.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form - in: query name: max_model_memory description: 'The maximum memory the forecast can use. If the forecast needs to use more than the provided amount, it will spool to disk. Default is 20mb, maximum is 500mb and minimum is 1mb. If set to 40% or more of the job’s configured memory limit, it is automatically reduced to below that amount.' deprecated: false schema: type: string style: form requestBody: content: application/json: schema: type: object properties: duration: description: Refer to the description for the `duration` query parameter. default: 1d allOf: - $ref: '#/components/schemas/_types.Duration' expires_in: description: Refer to the description for the `expires_in` query parameter. default: 14d allOf: - $ref: '#/components/schemas/_types.Duration' max_model_memory: description: Refer to the description for the `max_model_memory` query parameter. default: 20mb type: string examples: MlForecastExample1: description: An example body for a `POST _ml/anomaly_detectors/low_request_rate/_forecast` request. value: "{\n \"duration\": \"10d\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: acknowledged: type: boolean forecast_id: allOf: - $ref: '#/components/schemas/_types.Id' required: - acknowledged - forecast_id x-state: Generally available; Added in 6.1.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_forecast\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: forecast.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/anomaly_detectors/low_request_rate/_forecast\n{\n \"duration\": \"10d\"\n}" - lang: Python source: "resp = client.ml.forecast(\n job_id=\"low_request_rate\",\n duration=\"10d\",\n)" - lang: JavaScript source: "const response = await client.ml.forecast({\n job_id: \"low_request_rate\",\n duration: \"10d\",\n});" - lang: Ruby source: "response = client.ml.forecast(\n job_id: \"low_request_rate\",\n body: {\n \"duration\": \"10d\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->forecast([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"duration\" => \"10d\",\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"duration":"10d"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_forecast"' - lang: Java source: "client.ml().forecast(f -> f\n .duration(d -> d\n .time(\"10d\")\n )\n .jobId(\"low_request_rate\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete forecasts from a job description: 'By default, forecasts are retained for 14 days. You can specify a different retention period with the `expires_in` parameter in the forecast jobs API. The delete forecast API enables you to delete one or more forecasts before they expire.' operationId: ml-delete-forecast parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_forecasts description: 'Specifies whether an error occurs when there are no forecasts. In particular, if this parameter is set to `false` and there are no forecasts associated with the job, attempts to delete all forecasts return an error.' deprecated: false schema: type: boolean style: form - in: query name: timeout description: 'Specifies the period of time to wait for the completion of the delete operation. When this period of time elapses, the API fails and returns an error.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteForecastResponseExample1: description: A successful response when deleting a forecast from an anomaly detection job. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 6.5.0 x-variations: - "
\n DELETE\n /_ml/anomaly_detectors/{job_id}/_forecast\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_forecast.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/anomaly_detectors/total-requests/_forecast/_all ' - lang: Python source: "resp = client.ml.delete_forecast(\n job_id=\"total-requests\",\n forecast_id=\"_all\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteForecast({\n job_id: \"total-requests\",\n forecast_id: \"_all\",\n});" - lang: Ruby source: "response = client.ml.delete_forecast(\n job_id: \"total-requests\",\n forecast_id: \"_all\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteForecast([\n \"job_id\" => \"total-requests\",\n \"forecast_id\" => \"_all\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/total-requests/_forecast/_all"' - lang: Java source: "client.ml().deleteForecast(d -> d\n .forecastId(\"_all\")\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_forecast/{forecast_id}: delete: tags: - ml anomaly summary: Delete forecasts from a job description: 'By default, forecasts are retained for 14 days. You can specify a different retention period with the `expires_in` parameter in the forecast jobs API. The delete forecast API enables you to delete one or more forecasts before they expire.' operationId: ml-delete-forecast-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: forecast_id description: 'A comma-separated list of forecast identifiers. If you do not specify this optional parameter or if you specify `_all` or `*` the API deletes all forecasts from the job.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_forecasts description: 'Specifies whether an error occurs when there are no forecasts. In particular, if this parameter is set to `false` and there are no forecasts associated with the job, attempts to delete all forecasts return an error.' deprecated: false schema: type: boolean style: form - in: query name: timeout description: 'Specifies the period of time to wait for the completion of the delete operation. When this period of time elapses, the API fails and returns an error.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteForecastResponseExample1: description: A successful response when deleting a forecast from an anomaly detection job. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 6.5.0 x-variations: - "
\n DELETE\n /_ml/anomaly_detectors/{job_id}/_forecast/{forecast_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_forecast.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/anomaly_detectors/total-requests/_forecast/_all ' - lang: Python source: "resp = client.ml.delete_forecast(\n job_id=\"total-requests\",\n forecast_id=\"_all\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteForecast({\n job_id: \"total-requests\",\n forecast_id: \"_all\",\n});" - lang: Ruby source: "response = client.ml.delete_forecast(\n job_id: \"total-requests\",\n forecast_id: \"_all\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteForecast([\n \"job_id\" => \"total-requests\",\n \"forecast_id\" => \"_all\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/total-requests/_forecast/_all"' - lang: Java source: "client.ml().deleteForecast(d -> d\n .forecastId(\"_all\")\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}: get: tags: - ml anomaly summary: Get anomaly detection jobs configuration info description: 'You can get information for multiple anomaly detection jobs in a single API request by using a group name, a comma-separated list of jobs, or a wildcard expression. You can get information for all anomaly detection jobs by using `_all`, by specifying `*` as the ``, or by omitting the ``.' operationId: ml-get-jobs parameters: - in: path name: job_id description: 'Identifier for the anomaly detection job. It can be a job identifier, a group name, or a wildcard expression. If you do not specify one of these options, the API returns information for all anomaly detection jobs.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the _all string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: exclude_generated description: 'Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number jobs: type: array items: $ref: '#/components/schemas/ml._types.Job' required: - count - jobs x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_jobs.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/anomaly_detectors/high_sum_total_sales ' - lang: Python source: "resp = client.ml.get_jobs(\n job_id=\"high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getJobs({\n job_id: \"high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_jobs(\n job_id: \"high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getJobs([\n \"job_id\" => \"high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales"' - lang: Java source: "client.ml().getJobs(g -> g\n .jobId(\"high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name put: tags: - ml anomaly summary: Create an anomaly detection job description: 'If you include a `datafeed_config`, you must have read index privileges on the source index. If you include a `datafeed_config` but do not provide a query, the datafeed uses `{"match_all": {"boost": 1}}`.' operationId: ml-put-job parameters: - in: path name: job_id description: The identifier for the anomaly detection job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_indices description: 'If `true`, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the `_all` string or when no indices are specified.' deprecated: false schema: type: boolean style: form - in: query name: expand_wildcards description: "Type of index that wildcard patterns can match. If the request can target data streams, this argument determines\nwhether wildcard expressions match hidden data streams. Supports comma-separated values.\n\nSupported values include:\n - `all`: Match any data stream or index, including hidden ones.\n - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream.\n - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.\n - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`.\n - `none`: Wildcard expressions are not accepted.\n\n" deprecated: false schema: $ref: '#/components/schemas/_types.ExpandWildcards' style: form - in: query name: ignore_throttled description: If `true`, concrete, expanded or aliased indices are ignored when frozen. deprecated: true schema: type: boolean style: form - in: query name: ignore_unavailable description: If `true`, unavailable indices (missing or closed) are ignored. deprecated: false schema: type: boolean style: form requestBody: content: application/json: schema: type: object properties: allow_lazy_open: description: Advanced configuration option. Specifies whether this job can open when there is insufficient machine learning node capacity for it to be immediately assigned to a node. By default, if a machine learning node with capacity to run the job cannot immediately be found, the open anomaly detection jobs API returns an error. However, this is also subject to the cluster-wide `xpack.ml.max_lazy_ml_nodes` setting. If this option is set to true, the open anomaly detection jobs API does not return an error and the job waits in the opening state until sufficient machine learning node capacity is available. default: false type: boolean analysis_config: description: Specifies how to analyze the data. After you create a job, you cannot change the analysis configuration; all the properties are informational. allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfig' analysis_limits: description: Limits can be applied for the resources required to hold the mathematical models in memory. These limits are approximate and can be set per job. They do not control the memory used by other processes, for example the Elasticsearch Java processes. allOf: - $ref: '#/components/schemas/ml._types.AnalysisLimits' background_persist_interval: description: Advanced configuration option. The time between each periodic persistence of the model. The default value is a randomized value between 3 to 4 hours, which avoids all jobs persisting at exactly the same time. The smallest allowed value is 1 hour. For very large models (several GB), persistence could take 10-20 minutes, so do not set the `background_persist_interval` value too low. allOf: - $ref: '#/components/schemas/_types.Duration' custom_settings: description: Advanced configuration option. Contains custom meta data about the job. allOf: - $ref: '#/components/schemas/ml._types.CustomSettings' daily_model_snapshot_retention_after_days: description: Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies a period of time (in days) after which only the first snapshot per day is retained. This period is relative to the timestamp of the most recent snapshot for this job. Valid values range from 0 to `model_snapshot_retention_days`. default: 1.0 type: number data_description: description: Defines the format of the input data when you send data to the job by using the post data API. Note that when configure a datafeed, these properties are automatically set. When data is received via the post data API, it is not stored in Elasticsearch. Only the results for anomaly detection are retained. allOf: - $ref: '#/components/schemas/ml._types.DataDescription' datafeed_config: description: Defines a datafeed for the anomaly detection job. If Elasticsearch security features are enabled, your datafeed remembers which roles the user who created it had at the time of creation and runs the query using those same roles. If you provide secondary authorization headers, those credentials are used instead. allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' description: description: A description of the job. type: string job_id: description: The identifier for the anomaly detection job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters. allOf: - $ref: '#/components/schemas/_types.Id' groups: description: A list of job groups. A job can belong to no groups or many. type: array items: type: string model_plot_config: description: This advanced configuration option stores model information along with the results. It provides a more detailed view into anomaly detection. If you enable model plot it can add considerable overhead to the performance of the system; it is not feasible for jobs with many entities. Model plot provides a simplified and indicative view of the model and its bounds. It does not display complex features such as multivariate correlations or multimodal data. As such, anomalies may occasionally be reported which cannot be seen in the model plot. Model plot config can be configured when the job is created or updated later. It must be disabled if performance issues are experienced. allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_snapshot_retention_days: description: Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies the maximum period of time (in days) that snapshots are retained. This period is relative to the timestamp of the most recent snapshot for this job. By default, snapshots ten days older than the newest snapshot are deleted. default: 10.0 type: number renormalization_window_days: description: Advanced configuration option. The period over which adjustments to the score are applied, as new data is seen. The default value is the longer of 30 days or 100 bucket spans. type: number results_index_name: description: A text string that affects the name of the machine learning results index. By default, the job generates an index named `.ml-anomalies-shared`. default: shared allOf: - $ref: '#/components/schemas/_types.IndexName' results_retention_days: description: Advanced configuration option. The period of time (in days) that results are retained. Age is calculated relative to the timestamp of the latest bucket result. If this property has a non-null value, once per day at 00:30 (server time), results that are the specified number of days older than the latest bucket result are deleted from Elasticsearch. The default value is null, which means all results are retained. Annotations generated by the system also count as results for retention purposes; they are deleted after the same number of days as results. Annotations added by users are retained forever. type: number required: - analysis_config - data_description examples: MlPutJobRequestExample1: description: A request to create an anomaly detection job and datafeed. value: "{\n \"analysis_config\": {\n \"bucket_span\": \"15m\",\n \"detectors\": [\n {\n \"detector_description\": \"Sum of bytes\",\n \"function\": \"sum\",\n \"field_name\": \"bytes\"\n }\n ]\n },\n \"data_description\": {\n \"time_field\": \"timestamp\",\n \"time_format\": \"epoch_ms\"\n },\n \"analysis_limits\": {\n \"model_memory_limit\": \"11MB\"\n },\n \"model_plot_config\": {\n \"enabled\": true,\n \"annotations_enabled\": true\n },\n \"results_index_name\": \"test-job1\",\n \"datafeed_config\": {\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"runtime_mappings\": {\n \"hour_of_day\": {\n \"type\": \"long\",\n \"script\": {\n \"source\": \"emit(doc['timestamp'].value.getHour());\"\n }\n }\n },\n \"datafeed_id\": \"datafeed-test-job1\"\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: allow_lazy_open: type: boolean analysis_config: allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfigRead' analysis_limits: allOf: - $ref: '#/components/schemas/ml._types.AnalysisLimits' background_persist_interval: allOf: - $ref: '#/components/schemas/_types.Duration' create_time: allOf: - $ref: '#/components/schemas/_types.DateTime' custom_settings: allOf: - $ref: '#/components/schemas/ml._types.CustomSettings' daily_model_snapshot_retention_after_days: type: number data_description: allOf: - $ref: '#/components/schemas/ml._types.DataDescription' datafeed_config: allOf: - $ref: '#/components/schemas/ml._types.Datafeed' description: type: string groups: type: array items: type: string job_id: allOf: - $ref: '#/components/schemas/_types.Id' job_type: type: string job_version: type: string model_plot_config: allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_snapshot_id: allOf: - $ref: '#/components/schemas/_types.Id' model_snapshot_retention_days: type: number renormalization_window_days: type: number results_index_name: type: string results_retention_days: type: number required: - allow_lazy_open - analysis_config - analysis_limits - create_time - daily_model_snapshot_retention_after_days - data_description - job_id - job_type - job_version - model_snapshot_retention_days - results_index_name examples: MlPutJobResponseExample1: description: A successful response when creating an anomaly detection job and datafeed. value: "{\n \"job_id\": \"test-job1\",\n \"job_type\": \"anomaly_detector\",\n \"job_version\": \"8.4.0\",\n \"create_time\": 1656087283340,\n \"datafeed_config\": {\n \"datafeed_id\": \"datafeed-test-job1\",\n \"job_id\": \"test-job1\",\n \"authorization\": {\n \"roles\": [\n \"superuser\"\n ]\n },\n \"query_delay\": \"61499ms\",\n \"chunking_config\": {\n \"mode\": \"auto\"\n },\n \"indices_options\": {\n \"expand_wildcards\": [\n \"open\"\n ],\n \"ignore_unavailable\": false,\n \"allow_no_indices\": true,\n \"ignore_throttled\": true\n },\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"scroll_size\": 1000,\n \"delayed_data_check_config\": {\n \"enabled\": true\n },\n \"runtime_mappings\": {\n \"hour_of_day\": {\n \"type\": \"long\",\n \"script\": {\n \"source\": \"emit(doc['timestamp'].value.getHour());\"\n }\n }\n }\n },\n \"analysis_config\": {\n \"bucket_span\": \"15m\",\n \"detectors\": [\n {\n \"detector_description\": \"Sum of bytes\",\n \"function\": \"sum\",\n \"field_name\": \"bytes\",\n \"detector_index\": 0\n }\n ],\n \"influencers\": [],\n \"model_prune_window\": \"30d\"\n },\n \"analysis_limits\": {\n \"model_memory_limit\": \"11mb\",\n \"categorization_examples_limit\": 4\n },\n \"data_description\": {\n \"time_field\": \"timestamp\",\n \"time_format\": \"epoch_ms\"\n },\n \"model_plot_config\": {\n \"enabled\": true,\n \"annotations_enabled\": true\n },\n \"model_snapshot_retention_days\": 10,\n \"daily_model_snapshot_retention_after_days\": 1,\n \"results_index_name\": \"custom-test-job1\",\n \"allow_lazy_open\": false\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n PUT\n /_ml/anomaly_detectors/{job_id}\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: put_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: "PUT /_ml/anomaly_detectors/job-01\n{\n \"analysis_config\": {\n \"bucket_span\": \"15m\",\n \"detectors\": [\n {\n \"detector_description\": \"Sum of bytes\",\n \"function\": \"sum\",\n \"field_name\": \"bytes\"\n }\n ]\n },\n \"data_description\": {\n \"time_field\": \"timestamp\",\n \"time_format\": \"epoch_ms\"\n },\n \"analysis_limits\": {\n \"model_memory_limit\": \"11MB\"\n },\n \"model_plot_config\": {\n \"enabled\": true,\n \"annotations_enabled\": true\n },\n \"results_index_name\": \"test-job1\",\n \"datafeed_config\": {\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"runtime_mappings\": {\n \"hour_of_day\": {\n \"type\": \"long\",\n \"script\": {\n \"source\": \"emit(doc['timestamp'].value.getHour());\"\n }\n }\n },\n \"datafeed_id\": \"datafeed-test-job1\"\n }\n}" - lang: Python source: "resp = client.ml.put_job(\n job_id=\"job-01\",\n analysis_config={\n \"bucket_span\": \"15m\",\n \"detectors\": [\n {\n \"detector_description\": \"Sum of bytes\",\n \"function\": \"sum\",\n \"field_name\": \"bytes\"\n }\n ]\n },\n data_description={\n \"time_field\": \"timestamp\",\n \"time_format\": \"epoch_ms\"\n },\n analysis_limits={\n \"model_memory_limit\": \"11MB\"\n },\n model_plot_config={\n \"enabled\": True,\n \"annotations_enabled\": True\n },\n results_index_name=\"test-job1\",\n datafeed_config={\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"runtime_mappings\": {\n \"hour_of_day\": {\n \"type\": \"long\",\n \"script\": {\n \"source\": \"emit(doc['timestamp'].value.getHour());\"\n }\n }\n },\n \"datafeed_id\": \"datafeed-test-job1\"\n },\n)" - lang: JavaScript source: "const response = await client.ml.putJob({\n job_id: \"job-01\",\n analysis_config: {\n bucket_span: \"15m\",\n detectors: [\n {\n detector_description: \"Sum of bytes\",\n function: \"sum\",\n field_name: \"bytes\",\n },\n ],\n },\n data_description: {\n time_field: \"timestamp\",\n time_format: \"epoch_ms\",\n },\n analysis_limits: {\n model_memory_limit: \"11MB\",\n },\n model_plot_config: {\n enabled: true,\n annotations_enabled: true,\n },\n results_index_name: \"test-job1\",\n datafeed_config: {\n indices: [\"kibana_sample_data_logs\"],\n query: {\n bool: {\n must: [\n {\n match_all: {},\n },\n ],\n },\n },\n runtime_mappings: {\n hour_of_day: {\n type: \"long\",\n script: {\n source: \"emit(doc['timestamp'].value.getHour());\",\n },\n },\n },\n datafeed_id: \"datafeed-test-job1\",\n },\n});" - lang: Ruby source: "response = client.ml.put_job(\n job_id: \"job-01\",\n body: {\n \"analysis_config\": {\n \"bucket_span\": \"15m\",\n \"detectors\": [\n {\n \"detector_description\": \"Sum of bytes\",\n \"function\": \"sum\",\n \"field_name\": \"bytes\"\n }\n ]\n },\n \"data_description\": {\n \"time_field\": \"timestamp\",\n \"time_format\": \"epoch_ms\"\n },\n \"analysis_limits\": {\n \"model_memory_limit\": \"11MB\"\n },\n \"model_plot_config\": {\n \"enabled\": true,\n \"annotations_enabled\": true\n },\n \"results_index_name\": \"test-job1\",\n \"datafeed_config\": {\n \"indices\": [\n \"kibana_sample_data_logs\"\n ],\n \"query\": {\n \"bool\": {\n \"must\": [\n {\n \"match_all\": {}\n }\n ]\n }\n },\n \"runtime_mappings\": {\n \"hour_of_day\": {\n \"type\": \"long\",\n \"script\": {\n \"source\": \"emit(doc['timestamp'].value.getHour());\"\n }\n }\n },\n \"datafeed_id\": \"datafeed-test-job1\"\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->putJob([\n \"job_id\" => \"job-01\",\n \"body\" => [\n \"analysis_config\" => [\n \"bucket_span\" => \"15m\",\n \"detectors\" => array(\n [\n \"detector_description\" => \"Sum of bytes\",\n \"function\" => \"sum\",\n \"field_name\" => \"bytes\",\n ],\n ),\n ],\n \"data_description\" => [\n \"time_field\" => \"timestamp\",\n \"time_format\" => \"epoch_ms\",\n ],\n \"analysis_limits\" => [\n \"model_memory_limit\" => \"11MB\",\n ],\n \"model_plot_config\" => [\n \"enabled\" => true,\n \"annotations_enabled\" => true,\n ],\n \"results_index_name\" => \"test-job1\",\n \"datafeed_config\" => [\n \"indices\" => array(\n \"kibana_sample_data_logs\",\n ),\n \"query\" => [\n \"bool\" => [\n \"must\" => array(\n [\n \"match_all\" => new ArrayObject([]),\n ],\n ),\n ],\n ],\n \"runtime_mappings\" => [\n \"hour_of_day\" => [\n \"type\" => \"long\",\n \"script\" => [\n \"source\" => \"emit(doc['timestamp'].value.getHour());\",\n ],\n ],\n ],\n \"datafeed_id\" => \"datafeed-test-job1\",\n ],\n ],\n]);" - lang: curl source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"analysis_config":{"bucket_span":"15m","detectors":[{"detector_description":"Sum of bytes","function":"sum","field_name":"bytes"}]},"data_description":{"time_field":"timestamp","time_format":"epoch_ms"},"analysis_limits":{"model_memory_limit":"11MB"},"model_plot_config":{"enabled":true,"annotations_enabled":true},"results_index_name":"test-job1","datafeed_config":{"indices":["kibana_sample_data_logs"],"query":{"bool":{"must":[{"match_all":{}}]}},"runtime_mappings":{"hour_of_day":{"type":"long","script":{"source":"emit(doc[''"''"''timestamp''"''"''].value.getHour());"}}},"datafeed_id":"datafeed-test-job1"}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-01"' - lang: Java source: "client.ml().putJob(p -> p\n .analysisConfig(a -> a\n .bucketSpan(b -> b\n .time(\"15m\")\n )\n .detectors(d -> d\n .detectorDescription(\"Sum of bytes\")\n .fieldName(\"bytes\")\n .function(\"sum\")\n )\n )\n .analysisLimits(an -> an\n .modelMemoryLimit(\"11MB\")\n )\n .dataDescription(d -> d\n .timeField(\"timestamp\")\n .timeFormat(\"epoch_ms\")\n )\n .datafeedConfig(d -> d\n .datafeedId(\"datafeed-test-job1\")\n .indices(\"kibana_sample_data_logs\")\n .query(q -> q\n .bool(b -> b\n .must(m -> m\n .matchAll(ma -> ma)\n )\n )\n )\n .runtimeMappings(\"hour_of_day\", r -> r\n .script(s -> s\n .source(so -> so\n .scriptString(\"emit(doc['timestamp'].value.getHour());\")\n )\n )\n .type(RuntimeFieldType.Long)\n )\n )\n .jobId(\"job-01\")\n .modelPlotConfig(m -> m\n .annotationsEnabled(true)\n .enabled(true)\n )\n .resultsIndexName(\"test-job1\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete an anomaly detection job description: 'All job configuration, model state and results are deleted. It is not currently possible to delete multiple jobs using wildcards or a comma separated list. If you delete a job that has a datafeed, the request first tries to delete the datafeed. This behavior is equivalent to calling the delete datafeed API with the same timeout and force parameters as the delete job request.' operationId: ml-delete-job parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: force description: 'Use to forcefully delete an opened job; this method is quicker than closing and deleting the job.' deprecated: false schema: type: boolean style: form - in: query name: delete_user_annotations description: 'Specifies whether annotations that have been added by the user should be deleted along with any auto-generated annotations when the job is reset.' deprecated: false schema: type: boolean style: form - in: query name: wait_for_completion description: 'Specifies whether the request should return immediately or wait until the job deletion completes.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteJobResponseExample1: summary: Delete job description: A successful response when deleting an anomaly detection job. value: "{\n \"acknowledged\": true\n}" MlDeleteJobResponseExample2: summary: Delete job asynchronously description: 'A successful response when deleting an anomaly detection job asynchronously. When the `wait_for_completion` query parameter is set to `false`, the response contains an identifier for the job deletion task. ' value: "{\n \"task\": \"oTUltX4IQMOUUVeiohTt8A:39\"\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/anomaly_detectors/{job_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/anomaly_detectors/total-requests ' - lang: Python source: "resp = client.ml.delete_job(\n job_id=\"total-requests\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteJob({\n job_id: \"total-requests\",\n});" - lang: Ruby source: "response = client.ml.delete_job(\n job_id: \"total-requests\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteJob([\n \"job_id\" => \"total-requests\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/total-requests"' - lang: Java source: "client.ml().deleteJob(d -> d\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}: get: tags: - ml anomaly summary: Get model snapshots info operationId: ml-get-model-snapshots parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: 'A numerical character string that uniquely identifies the model snapshot. You can get information for multiple snapshots by using a comma-separated list or a wildcard expression. You can get all snapshots by using `_all`, by specifying `*` as the snapshot ID, or by omitting the snapshot ID.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: Returns snapshots with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: from description: Skips the specified number of snapshots. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of snapshots to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested snapshots. By default, the snapshots are sorted by their timestamp.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: Returns snapshots with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the description for the `sort` query parameter. allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetModelSnapshotsExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots` request. value: "{\n \"start\": \"1575402236000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number model_snapshots: type: array items: $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - count - model_snapshots x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_model_snapshots.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots\n{\n \"start\": \"1575402236000\"\n}" - lang: Python source: "resp = client.ml.get_model_snapshots(\n job_id=\"high_sum_total_sales\",\n start=\"1575402236000\",\n)" - lang: JavaScript source: "const response = await client.ml.getModelSnapshots({\n job_id: \"high_sum_total_sales\",\n start: 1575402236000,\n});" - lang: Ruby source: "response = client.ml.get_model_snapshots(\n job_id: \"high_sum_total_sales\",\n body: {\n \"start\": \"1575402236000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getModelSnapshots([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"start\" => \"1575402236000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"start":"1575402236000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/model_snapshots"' - lang: Java source: "client.ml().getModelSnapshots(g -> g\n .jobId(\"high_sum_total_sales\")\n .start(DateTime.of(\"1575402236000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get model snapshots info operationId: ml-get-model-snapshots-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: 'A numerical character string that uniquely identifies the model snapshot. You can get information for multiple snapshots by using a comma-separated list or a wildcard expression. You can get all snapshots by using `_all`, by specifying `*` as the snapshot ID, or by omitting the snapshot ID.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: Returns snapshots with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: from description: Skips the specified number of snapshots. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of snapshots to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested snapshots. By default, the snapshots are sorted by their timestamp.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: Returns snapshots with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the description for the `sort` query parameter. allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetModelSnapshotsExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots` request. value: "{\n \"start\": \"1575402236000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number model_snapshots: type: array items: $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - count - model_snapshots x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_model_snapshots.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots\n{\n \"start\": \"1575402236000\"\n}" - lang: Python source: "resp = client.ml.get_model_snapshots(\n job_id=\"high_sum_total_sales\",\n start=\"1575402236000\",\n)" - lang: JavaScript source: "const response = await client.ml.getModelSnapshots({\n job_id: \"high_sum_total_sales\",\n start: 1575402236000,\n});" - lang: Ruby source: "response = client.ml.get_model_snapshots(\n job_id: \"high_sum_total_sales\",\n body: {\n \"start\": \"1575402236000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getModelSnapshots([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"start\" => \"1575402236000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"start":"1575402236000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/model_snapshots"' - lang: Java source: "client.ml().getModelSnapshots(g -> g\n .jobId(\"high_sum_total_sales\")\n .start(DateTime.of(\"1575402236000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name delete: tags: - ml anomaly summary: Delete a model snapshot description: 'You cannot delete the active model snapshot. To delete that snapshot, first revert to a different one. To identify the active model snapshot, refer to the `model_snapshot_id` in the results from the get jobs API.' operationId: ml-delete-model-snapshot parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: Identifier for the model snapshot. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' examples: MlDeleteModelSnapshotResponseExample1: description: A successful response when deleting an existing model snapshot. value: "{\n \"acknowledged\": true\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n DELETE\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: delete_model_snapshot.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'DELETE _ml/anomaly_detectors/farequote/model_snapshots/1491948163 ' - lang: Python source: "resp = client.ml.delete_model_snapshot(\n job_id=\"farequote\",\n snapshot_id=\"1491948163\",\n)" - lang: JavaScript source: "const response = await client.ml.deleteModelSnapshot({\n job_id: \"farequote\",\n snapshot_id: 1491948163,\n});" - lang: Ruby source: "response = client.ml.delete_model_snapshot(\n job_id: \"farequote\",\n snapshot_id: \"1491948163\"\n)" - lang: PHP source: "$resp = $client->ml()->deleteModelSnapshot([\n \"job_id\" => \"farequote\",\n \"snapshot_id\" => \"1491948163\",\n]);" - lang: curl source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/farequote/model_snapshots/1491948163"' - lang: Java source: "client.ml().deleteModelSnapshot(d -> d\n .jobId(\"farequote\")\n .snapshotId(\"1491948163\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/_estimate_model_memory: post: tags: - ml anomaly summary: Estimate job model memory usage description: 'Make an estimation of the memory usage for an anomaly detection job model. The estimate is based on analysis configuration details for the job and cardinality estimates for the fields it references.' operationId: ml-estimate-model-memory requestBody: content: application/json: schema: type: object properties: analysis_config: description: 'For a list of the properties that you can specify in the `analysis_config` component of the body of this API.' allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfig' max_bucket_cardinality: description: 'Estimates of the highest cardinality in a single bucket that is observed for influencer fields over the time period that the job analyzes data. To produce a good answer, values must be provided for all influencer fields. Providing values for fields that are not listed as `influencers` has no effect on the estimation.' type: object additionalProperties: type: number overall_cardinality: description: 'Estimates of the cardinality that is observed for fields over the whole time period that the job analyzes data. To produce a good answer, values must be provided for fields referenced in the `by_field_name`, `over_field_name` and `partition_field_name` of any detectors. Providing values for other fields has no effect on the estimation. It can be omitted from the request if no detectors have a `by_field_name`, `over_field_name` or `partition_field_name`.' type: object additionalProperties: type: number examples: MlEstimateModelMemoryRequestExample1: description: Run `POST _ml/anomaly_detectors/_estimate_model_memory` to estimate the model memory limit based on the analysis configuration details provided in the request body. value: "{\n \"analysis_config\": {\n \"bucket_span\": \"5m\",\n \"detectors\": [\n {\n \"function\": \"sum\",\n \"field_name\": \"bytes\",\n \"by_field_name\": \"status\",\n \"partition_field_name\": \"app\"\n }\n ],\n \"influencers\": [\n \"source_ip\",\n \"dest_ip\"\n ]\n },\n \"overall_cardinality\": {\n \"status\": 10,\n \"app\": 50\n },\n \"max_bucket_cardinality\": {\n \"source_ip\": 300,\n \"dest_ip\": 30\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: model_memory_estimate: type: string required: - model_memory_estimate examples: MlEstimateModelMemoryResponseExample1: description: A successful response from `POST _ml/anomaly_detectors/_estimate_model_memory`. value: "{\n \"model_memory_estimate\": \"21mb\"\n}" x-state: Generally available; Added in 7.7.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/_estimate_model_memory\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: estimate_model_memory.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/anomaly_detectors/_estimate_model_memory\n{\n \"analysis_config\": {\n \"bucket_span\": \"5m\",\n \"detectors\": [\n {\n \"function\": \"sum\",\n \"field_name\": \"bytes\",\n \"by_field_name\": \"status\",\n \"partition_field_name\": \"app\"\n }\n ],\n \"influencers\": [\n \"source_ip\",\n \"dest_ip\"\n ]\n },\n \"overall_cardinality\": {\n \"status\": 10,\n \"app\": 50\n },\n \"max_bucket_cardinality\": {\n \"source_ip\": 300,\n \"dest_ip\": 30\n }\n}" - lang: Python source: "resp = client.ml.estimate_model_memory(\n analysis_config={\n \"bucket_span\": \"5m\",\n \"detectors\": [\n {\n \"function\": \"sum\",\n \"field_name\": \"bytes\",\n \"by_field_name\": \"status\",\n \"partition_field_name\": \"app\"\n }\n ],\n \"influencers\": [\n \"source_ip\",\n \"dest_ip\"\n ]\n },\n overall_cardinality={\n \"status\": 10,\n \"app\": 50\n },\n max_bucket_cardinality={\n \"source_ip\": 300,\n \"dest_ip\": 30\n },\n)" - lang: JavaScript source: "const response = await client.ml.estimateModelMemory({\n analysis_config: {\n bucket_span: \"5m\",\n detectors: [\n {\n function: \"sum\",\n field_name: \"bytes\",\n by_field_name: \"status\",\n partition_field_name: \"app\",\n },\n ],\n influencers: [\"source_ip\", \"dest_ip\"],\n },\n overall_cardinality: {\n status: 10,\n app: 50,\n },\n max_bucket_cardinality: {\n source_ip: 300,\n dest_ip: 30,\n },\n});" - lang: Ruby source: "response = client.ml.estimate_model_memory(\n body: {\n \"analysis_config\": {\n \"bucket_span\": \"5m\",\n \"detectors\": [\n {\n \"function\": \"sum\",\n \"field_name\": \"bytes\",\n \"by_field_name\": \"status\",\n \"partition_field_name\": \"app\"\n }\n ],\n \"influencers\": [\n \"source_ip\",\n \"dest_ip\"\n ]\n },\n \"overall_cardinality\": {\n \"status\": 10,\n \"app\": 50\n },\n \"max_bucket_cardinality\": {\n \"source_ip\": 300,\n \"dest_ip\": 30\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->estimateModelMemory([\n \"body\" => [\n \"analysis_config\" => [\n \"bucket_span\" => \"5m\",\n \"detectors\" => array(\n [\n \"function\" => \"sum\",\n \"field_name\" => \"bytes\",\n \"by_field_name\" => \"status\",\n \"partition_field_name\" => \"app\",\n ],\n ),\n \"influencers\" => array(\n \"source_ip\",\n \"dest_ip\",\n ),\n ],\n \"overall_cardinality\" => [\n \"status\" => 10,\n \"app\" => 50,\n ],\n \"max_bucket_cardinality\" => [\n \"source_ip\" => 300,\n \"dest_ip\" => 30,\n ],\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"analysis_config":{"bucket_span":"5m","detectors":[{"function":"sum","field_name":"bytes","by_field_name":"status","partition_field_name":"app"}],"influencers":["source_ip","dest_ip"]},"overall_cardinality":{"status":10,"app":50},"max_bucket_cardinality":{"source_ip":300,"dest_ip":30}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/_estimate_model_memory"' - lang: Java source: "client.ml().estimateModelMemory(e -> e\n .analysisConfig(a -> a\n .bucketSpan(b -> b\n .time(\"5m\")\n )\n .detectors(d -> d\n .byFieldName(\"status\")\n .fieldName(\"bytes\")\n .function(\"sum\")\n .partitionFieldName(\"app\")\n )\n .influencers(List.of(\"source_ip\",\"dest_ip\"))\n )\n .maxBucketCardinality(Map.of(\"dest_ip\", 30L,\"source_ip\", 300L))\n .overallCardinality(Map.of(\"app\", 50L,\"status\", 10L))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_flush: post: tags: - ml anomaly summary: Force buffered data to be processed description: 'The flush jobs API is only applicable when sending data for analysis using the post data API. Depending on the content of the buffer, then it might additionally calculate new results. Both flush and close operations are similar, however the flush is more efficient if you are expecting to send more data for analysis. When flushing, the job remains open and is available to continue analyzing data. A close operation additionally prunes and persists the model state to disk and the job must be opened again before analyzing further data.' operationId: ml-flush-job parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: advance_time description: 'Specifies to advance to a particular time value. Results are generated and the model is updated for data from the specified time interval.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: calc_interim description: 'If true, calculates the interim results for the most recent bucket or all buckets within the latency period.' deprecated: false schema: type: boolean style: form - in: query name: end description: 'When used in conjunction with `calc_interim` and `start`, specifies the range of buckets on which to calculate interim results.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: skip_time description: 'Specifies to skip to a particular time value. Results are not generated and the model is not updated for data from the specified time interval.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: start description: 'When used in conjunction with `calc_interim`, specifies the range of buckets on which to calculate interim results.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: advance_time: description: Refer to the description for the `advance_time` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' calc_interim: description: Refer to the description for the `calc_interim` query parameter. type: boolean end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' skip_time: description: Refer to the description for the `skip_time` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlFlushJobExample1: description: An example body for a `POST _ml/anomaly_detectors/low_request_rate/_flush` request. value: "{\n \"calc_interim\": true\n}" responses: '200': description: '' content: application/json: schema: type: object properties: flushed: type: boolean last_finalized_bucket_end: description: 'Provides the timestamp (in milliseconds since the epoch) of the end of the last bucket that was processed.' type: number required: - flushed deprecated: true x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_flush\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: flush_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/anomaly_detectors/low_request_rate/_flush\n{\n \"calc_interim\": true\n}" - lang: Python source: "resp = client.ml.flush_job(\n job_id=\"low_request_rate\",\n calc_interim=True,\n)" - lang: JavaScript source: "const response = await client.ml.flushJob({\n job_id: \"low_request_rate\",\n calc_interim: true,\n});" - lang: Ruby source: "response = client.ml.flush_job(\n job_id: \"low_request_rate\",\n body: {\n \"calc_interim\": true\n }\n)" - lang: PHP source: "$resp = $client->ml()->flushJob([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"calc_interim\" => true,\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"calc_interim":true}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_flush"' - lang: Java source: "client.ml().flushJob(f -> f\n .calcInterim(true)\n .jobId(\"low_request_rate\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}: get: tags: - ml anomaly summary: Get anomaly detection job results for buckets description: The API presents a chronological view of the records, grouped by bucket. operationId: ml-get-buckets parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: timestamp description: 'The timestamp of a single bucket result. If you do not specify this parameter, the API returns information about all buckets.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: simple - in: query name: anomaly_score description: Returns buckets with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: desc description: If `true`, the buckets are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns buckets with timestamps earlier than this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: expand description: If true, the output includes anomaly records. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of buckets. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of buckets to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested buckets. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns buckets with timestamps after this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: anomaly_score: description: Refer to the description for the `anomaly_score` query parameter. default: 0.0 type: number desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean expand: description: Refer to the description for the `expand` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the desription for the `sort` query parameter. default: timestamp allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/buckets` request. value: "{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: buckets: type: array items: $ref: '#/components/schemas/ml._types.BucketSummary' count: type: number required: - buckets - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/buckets\n{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" - lang: Python source: "resp = client.ml.get_buckets(\n job_id=\"low_request_rate\",\n anomaly_score=80,\n start=\"1454530200001\",\n)" - lang: JavaScript source: "const response = await client.ml.getBuckets({\n job_id: \"low_request_rate\",\n anomaly_score: 80,\n start: 1454530200001,\n});" - lang: Ruby source: "response = client.ml.get_buckets(\n job_id: \"low_request_rate\",\n body: {\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getBuckets([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"anomaly_score\" => 80,\n \"start\" => \"1454530200001\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"anomaly_score":80,"start":"1454530200001"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/buckets"' - lang: Java source: "client.ml().getBuckets(g -> g\n .anomalyScore(80.0D)\n .jobId(\"low_request_rate\")\n .start(DateTime.of(\"1454530200001\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly detection job results for buckets description: The API presents a chronological view of the records, grouped by bucket. operationId: ml-get-buckets-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: timestamp description: 'The timestamp of a single bucket result. If you do not specify this parameter, the API returns information about all buckets.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: simple - in: query name: anomaly_score description: Returns buckets with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: desc description: If `true`, the buckets are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns buckets with timestamps earlier than this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: expand description: If true, the output includes anomaly records. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of buckets. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of buckets to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested buckets. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns buckets with timestamps after this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: anomaly_score: description: Refer to the description for the `anomaly_score` query parameter. default: 0.0 type: number desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean expand: description: Refer to the description for the `expand` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the desription for the `sort` query parameter. default: timestamp allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/buckets` request. value: "{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: buckets: type: array items: $ref: '#/components/schemas/ml._types.BucketSummary' count: type: number required: - buckets - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/buckets/{timestamp}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/buckets\n{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" - lang: Python source: "resp = client.ml.get_buckets(\n job_id=\"low_request_rate\",\n anomaly_score=80,\n start=\"1454530200001\",\n)" - lang: JavaScript source: "const response = await client.ml.getBuckets({\n job_id: \"low_request_rate\",\n anomaly_score: 80,\n start: 1454530200001,\n});" - lang: Ruby source: "response = client.ml.get_buckets(\n job_id: \"low_request_rate\",\n body: {\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getBuckets([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"anomaly_score\" => 80,\n \"start\" => \"1454530200001\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"anomaly_score":80,"start":"1454530200001"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/buckets"' - lang: Java source: "client.ml().getBuckets(g -> g\n .anomalyScore(80.0D)\n .jobId(\"low_request_rate\")\n .start(DateTime.of(\"1454530200001\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/buckets: get: tags: - ml anomaly summary: Get anomaly detection job results for buckets description: The API presents a chronological view of the records, grouped by bucket. operationId: ml-get-buckets-2 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: anomaly_score description: Returns buckets with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: desc description: If `true`, the buckets are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns buckets with timestamps earlier than this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: expand description: If true, the output includes anomaly records. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of buckets. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of buckets to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested buckets. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns buckets with timestamps after this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: anomaly_score: description: Refer to the description for the `anomaly_score` query parameter. default: 0.0 type: number desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean expand: description: Refer to the description for the `expand` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the desription for the `sort` query parameter. default: timestamp allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/buckets` request. value: "{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: buckets: type: array items: $ref: '#/components/schemas/ml._types.BucketSummary' count: type: number required: - buckets - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/buckets\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/buckets\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/buckets\n{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" - lang: Python source: "resp = client.ml.get_buckets(\n job_id=\"low_request_rate\",\n anomaly_score=80,\n start=\"1454530200001\",\n)" - lang: JavaScript source: "const response = await client.ml.getBuckets({\n job_id: \"low_request_rate\",\n anomaly_score: 80,\n start: 1454530200001,\n});" - lang: Ruby source: "response = client.ml.get_buckets(\n job_id: \"low_request_rate\",\n body: {\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getBuckets([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"anomaly_score\" => 80,\n \"start\" => \"1454530200001\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"anomaly_score":80,"start":"1454530200001"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/buckets"' - lang: Java source: "client.ml().getBuckets(g -> g\n .anomalyScore(80.0D)\n .jobId(\"low_request_rate\")\n .start(DateTime.of(\"1454530200001\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly detection job results for buckets description: The API presents a chronological view of the records, grouped by bucket. operationId: ml-get-buckets-3 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: anomaly_score description: Returns buckets with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: desc description: If `true`, the buckets are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns buckets with timestamps earlier than this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: expand description: If true, the output includes anomaly records. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of buckets. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of buckets to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested buckets. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns buckets with timestamps after this time. `-1` means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: anomaly_score: description: Refer to the description for the `anomaly_score` query parameter. default: 0.0 type: number desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean expand: description: Refer to the description for the `expand` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the desription for the `sort` query parameter. default: timestamp allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/buckets` request. value: "{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: buckets: type: array items: $ref: '#/components/schemas/ml._types.BucketSummary' count: type: number required: - buckets - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/buckets\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/buckets\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/buckets\n{\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n}" - lang: Python source: "resp = client.ml.get_buckets(\n job_id=\"low_request_rate\",\n anomaly_score=80,\n start=\"1454530200001\",\n)" - lang: JavaScript source: "const response = await client.ml.getBuckets({\n job_id: \"low_request_rate\",\n anomaly_score: 80,\n start: 1454530200001,\n});" - lang: Ruby source: "response = client.ml.get_buckets(\n job_id: \"low_request_rate\",\n body: {\n \"anomaly_score\": 80,\n \"start\": \"1454530200001\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getBuckets([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"anomaly_score\" => 80,\n \"start\" => \"1454530200001\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"anomaly_score":80,"start":"1454530200001"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/buckets"' - lang: Java source: "client.ml().getBuckets(g -> g\n .anomalyScore(80.0D)\n .jobId(\"low_request_rate\")\n .start(DateTime.of(\"1454530200001\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/calendars/{calendar_id}/events: get: tags: - ml anomaly summary: Get info about events in calendars operationId: ml-get-calendar-events parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. You can get information for multiple calendars by using a comma-separated list of ids or a wildcard expression. You can get information for all calendars by using `_all` or `*` or by omitting the calendar identifier. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: end description: Specifies to get events with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: from description: Skips the specified number of events. deprecated: false schema: type: number style: form - in: query name: job_id description: Specifies to get events for a specific anomaly detection job identifier or job group. It must be used with a calendar identifier of `_all` or `*`. deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: form - in: query name: size description: Specifies the maximum number of events to obtain. deprecated: false schema: type: number style: form - in: query name: start description: Specifies to get events with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number events: type: array items: $ref: '#/components/schemas/ml._types.CalendarEvent' required: - count - events x-state: Generally available; Added in 6.2.0 x-variations: - "
\n GET\n /_ml/calendars/{calendar_id}/events\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_calendar_events.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/calendars/planned-outages/events ' - lang: Python source: "resp = client.ml.get_calendar_events(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.getCalendarEvents({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.get_calendar_events(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->getCalendarEvents([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages/events"' - lang: Java source: "client.ml().getCalendarEvents(g -> g\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Add scheduled events to the calendar operationId: ml-post-calendar-events parameters: - in: path name: calendar_id description: A string that uniquely identifies a calendar. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: events: description: A list of one of more scheduled events. The event’s start and end times can be specified as integer milliseconds since the epoch or as a string in ISO 8601 format. type: array items: $ref: '#/components/schemas/ml._types.CalendarEvent' required: - events examples: MlPostCalendarEventsExample1: description: An example body for a `POST _ml/calendars/planned-outages/events` request. value: "{\n \"events\" : [\n {\"description\": \"event 1\", \"start_time\": 1513641600000, \"end_time\": 1513728000000},\n {\"description\": \"event 2\", \"start_time\": 1513814400000, \"end_time\": 1513900800000},\n {\"description\": \"event 3\", \"start_time\": 1514160000000, \"end_time\": 1514246400000}\n ]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: events: type: array items: $ref: '#/components/schemas/ml._types.CalendarEvent' required: - events x-state: Generally available; Added in 6.2.0 x-variations: - "
\n POST\n /_ml/calendars/{calendar_id}/events\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: post_calendar_events.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/calendars/planned-outages/events\n{\n \"events\" : [\n {\"description\": \"event 1\", \"start_time\": 1513641600000, \"end_time\": 1513728000000},\n {\"description\": \"event 2\", \"start_time\": 1513814400000, \"end_time\": 1513900800000},\n {\"description\": \"event 3\", \"start_time\": 1514160000000, \"end_time\": 1514246400000}\n ]\n}" - lang: Python source: "resp = client.ml.post_calendar_events(\n calendar_id=\"planned-outages\",\n events=[\n {\n \"description\": \"event 1\",\n \"start_time\": 1513641600000,\n \"end_time\": 1513728000000\n },\n {\n \"description\": \"event 2\",\n \"start_time\": 1513814400000,\n \"end_time\": 1513900800000\n },\n {\n \"description\": \"event 3\",\n \"start_time\": 1514160000000,\n \"end_time\": 1514246400000\n }\n ],\n)" - lang: JavaScript source: "const response = await client.ml.postCalendarEvents({\n calendar_id: \"planned-outages\",\n events: [\n {\n description: \"event 1\",\n start_time: 1513641600000,\n end_time: 1513728000000,\n },\n {\n description: \"event 2\",\n start_time: 1513814400000,\n end_time: 1513900800000,\n },\n {\n description: \"event 3\",\n start_time: 1514160000000,\n end_time: 1514246400000,\n },\n ],\n});" - lang: Ruby source: "response = client.ml.post_calendar_events(\n calendar_id: \"planned-outages\",\n body: {\n \"events\": [\n {\n \"description\": \"event 1\",\n \"start_time\": 1513641600000,\n \"end_time\": 1513728000000\n },\n {\n \"description\": \"event 2\",\n \"start_time\": 1513814400000,\n \"end_time\": 1513900800000\n },\n {\n \"description\": \"event 3\",\n \"start_time\": 1514160000000,\n \"end_time\": 1514246400000\n }\n ]\n }\n)" - lang: PHP source: "$resp = $client->ml()->postCalendarEvents([\n \"calendar_id\" => \"planned-outages\",\n \"body\" => [\n \"events\" => array(\n [\n \"description\" => \"event 1\",\n \"start_time\" => 1513641600000,\n \"end_time\" => 1513728000000,\n ],\n [\n \"description\" => \"event 2\",\n \"start_time\" => 1513814400000,\n \"end_time\" => 1513900800000,\n ],\n [\n \"description\" => \"event 3\",\n \"start_time\" => 1514160000000,\n \"end_time\" => 1514246400000,\n ],\n ),\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"events":[{"description":"event 1","start_time":1513641600000,"end_time":1513728000000},{"description":"event 2","start_time":1513814400000,"end_time":1513900800000},{"description":"event 3","start_time":1514160000000,"end_time":1514246400000}]}'' "$ELASTICSEARCH_URL/_ml/calendars/planned-outages/events"' - lang: Java source: "client.ml().postCalendarEvents(p -> p\n .calendarId(\"planned-outages\")\n .events(List.of(CalendarEvent.of(c -> c\n .description(\"event 1\")\n .endTime(DateTime.ofEpochMilli(1513728000000L))\n .startTime(DateTime.ofEpochMilli(1513641600000L))\n ),CalendarEvent.of(c -> c\n .description(\"event 2\")\n .endTime(DateTime.ofEpochMilli(1513900800000L))\n .startTime(DateTime.ofEpochMilli(1513814400000L))\n ),CalendarEvent.of(c -> c\n .description(\"event 3\")\n .endTime(DateTime.ofEpochMilli(1514246400000L))\n .startTime(DateTime.ofEpochMilli(1514160000000L))\n )))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/calendars: get: tags: - ml anomaly summary: Get calendar configuration info operationId: ml-get-calendars parameters: - in: query name: from description: Skips the specified number of calendars. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of calendars to obtain. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: This object is supported only when you omit the calendar identifier. allOf: - $ref: '#/components/schemas/ml._types.Page' responses: '200': description: '' content: application/json: schema: type: object properties: calendars: type: array items: $ref: '#/components/schemas/ml.get_calendars.Calendar' count: type: number required: - calendars - count x-state: Generally available; Added in 6.2.0 x-variations: - "
\n GET\n /_ml/calendars\n
\n " - "
\n POST\n /_ml/calendars\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_calendars.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.get_calendars(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.getCalendars({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.get_calendars(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->getCalendars([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().getCalendars(g -> g\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get calendar configuration info operationId: ml-get-calendars-1 parameters: - in: query name: from description: Skips the specified number of calendars. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of calendars to obtain. This parameter is supported only when you omit the calendar identifier. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: This object is supported only when you omit the calendar identifier. allOf: - $ref: '#/components/schemas/ml._types.Page' responses: '200': description: '' content: application/json: schema: type: object properties: calendars: type: array items: $ref: '#/components/schemas/ml.get_calendars.Calendar' count: type: number required: - calendars - count x-state: Generally available; Added in 6.2.0 x-variations: - "
\n GET\n /_ml/calendars\n
\n " - "
\n POST\n /_ml/calendars\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_calendars.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/calendars/planned-outages ' - lang: Python source: "resp = client.ml.get_calendars(\n calendar_id=\"planned-outages\",\n)" - lang: JavaScript source: "const response = await client.ml.getCalendars({\n calendar_id: \"planned-outages\",\n});" - lang: Ruby source: "response = client.ml.get_calendars(\n calendar_id: \"planned-outages\"\n)" - lang: PHP source: "$resp = $client->ml()->getCalendars([\n \"calendar_id\" => \"planned-outages\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/calendars/planned-outages"' - lang: Java source: "client.ml().getCalendars(g -> g\n .calendarId(\"planned-outages\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/categories/{category_id}: get: tags: - ml anomaly summary: Get anomaly detection job results for categories operationId: ml-get-categories parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: category_id description: 'Identifier for the category, which is unique in the job. If you specify neither the category ID nor the partition_field_value, the API returns information about all categories. If you specify only the partition_field_value, it returns information about all categories for the specified partition.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.CategoryId' style: simple - in: query name: from description: Skips the specified number of categories. deprecated: false schema: type: number style: form - in: query name: partition_field_value description: Only return categories for the specified partition. deprecated: false schema: type: string style: form - in: query name: size description: Specifies the maximum number of categories to obtain. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetCategoriesExample1: description: An example body for a `GET _ml/anomaly_detectors/esxi_log/results/categories` request. value: "{\n \"page\":{\n \"size\": 1\n }\n}" responses: '200': description: '' content: application/json: schema: type: object properties: categories: type: array items: $ref: '#/components/schemas/ml._types.Category' count: type: number required: - categories - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/categories/{category_id}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/categories/{category_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_categories.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/esxi_log/results/categories\n{\n \"page\":{\n \"size\": 1\n }\n}" - lang: Python source: "resp = client.ml.get_categories(\n job_id=\"esxi_log\",\n page={\n \"size\": 1\n },\n)" - lang: JavaScript source: "const response = await client.ml.getCategories({\n job_id: \"esxi_log\",\n page: {\n size: 1,\n },\n});" - lang: Ruby source: "response = client.ml.get_categories(\n job_id: \"esxi_log\",\n body: {\n \"page\": {\n \"size\": 1\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->getCategories([\n \"job_id\" => \"esxi_log\",\n \"body\" => [\n \"page\" => [\n \"size\" => 1,\n ],\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"page":{"size":1}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/esxi_log/results/categories"' - lang: Java source: "client.ml().getCategories(g -> g\n .jobId(\"esxi_log\")\n .page(p -> p\n .size(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly detection job results for categories operationId: ml-get-categories-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: category_id description: 'Identifier for the category, which is unique in the job. If you specify neither the category ID nor the partition_field_value, the API returns information about all categories. If you specify only the partition_field_value, it returns information about all categories for the specified partition.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.CategoryId' style: simple - in: query name: from description: Skips the specified number of categories. deprecated: false schema: type: number style: form - in: query name: partition_field_value description: Only return categories for the specified partition. deprecated: false schema: type: string style: form - in: query name: size description: Specifies the maximum number of categories to obtain. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetCategoriesExample1: description: An example body for a `GET _ml/anomaly_detectors/esxi_log/results/categories` request. value: "{\n \"page\":{\n \"size\": 1\n }\n}" responses: '200': description: '' content: application/json: schema: type: object properties: categories: type: array items: $ref: '#/components/schemas/ml._types.Category' count: type: number required: - categories - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/categories/{category_id}\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/categories/{category_id}\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_categories.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/esxi_log/results/categories\n{\n \"page\":{\n \"size\": 1\n }\n}" - lang: Python source: "resp = client.ml.get_categories(\n job_id=\"esxi_log\",\n page={\n \"size\": 1\n },\n)" - lang: JavaScript source: "const response = await client.ml.getCategories({\n job_id: \"esxi_log\",\n page: {\n size: 1,\n },\n});" - lang: Ruby source: "response = client.ml.get_categories(\n job_id: \"esxi_log\",\n body: {\n \"page\": {\n \"size\": 1\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->getCategories([\n \"job_id\" => \"esxi_log\",\n \"body\" => [\n \"page\" => [\n \"size\" => 1,\n ],\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"page":{"size":1}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/esxi_log/results/categories"' - lang: Java source: "client.ml().getCategories(g -> g\n .jobId(\"esxi_log\")\n .page(p -> p\n .size(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/categories: get: tags: - ml anomaly summary: Get anomaly detection job results for categories operationId: ml-get-categories-2 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: from description: Skips the specified number of categories. deprecated: false schema: type: number style: form - in: query name: partition_field_value description: Only return categories for the specified partition. deprecated: false schema: type: string style: form - in: query name: size description: Specifies the maximum number of categories to obtain. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetCategoriesExample1: description: An example body for a `GET _ml/anomaly_detectors/esxi_log/results/categories` request. value: "{\n \"page\":{\n \"size\": 1\n }\n}" responses: '200': description: '' content: application/json: schema: type: object properties: categories: type: array items: $ref: '#/components/schemas/ml._types.Category' count: type: number required: - categories - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/categories\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/categories\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_categories.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/esxi_log/results/categories\n{\n \"page\":{\n \"size\": 1\n }\n}" - lang: Python source: "resp = client.ml.get_categories(\n job_id=\"esxi_log\",\n page={\n \"size\": 1\n },\n)" - lang: JavaScript source: "const response = await client.ml.getCategories({\n job_id: \"esxi_log\",\n page: {\n size: 1,\n },\n});" - lang: Ruby source: "response = client.ml.get_categories(\n job_id: \"esxi_log\",\n body: {\n \"page\": {\n \"size\": 1\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->getCategories([\n \"job_id\" => \"esxi_log\",\n \"body\" => [\n \"page\" => [\n \"size\" => 1,\n ],\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"page":{"size":1}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/esxi_log/results/categories"' - lang: Java source: "client.ml().getCategories(g -> g\n .jobId(\"esxi_log\")\n .page(p -> p\n .size(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly detection job results for categories operationId: ml-get-categories-3 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: from description: Skips the specified number of categories. deprecated: false schema: type: number style: form - in: query name: partition_field_value description: Only return categories for the specified partition. deprecated: false schema: type: string style: form - in: query name: size description: Specifies the maximum number of categories to obtain. deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetCategoriesExample1: description: An example body for a `GET _ml/anomaly_detectors/esxi_log/results/categories` request. value: "{\n \"page\":{\n \"size\": 1\n }\n}" responses: '200': description: '' content: application/json: schema: type: object properties: categories: type: array items: $ref: '#/components/schemas/ml._types.Category' count: type: number required: - categories - count x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/categories\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/categories\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_categories.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/esxi_log/results/categories\n{\n \"page\":{\n \"size\": 1\n }\n}" - lang: Python source: "resp = client.ml.get_categories(\n job_id=\"esxi_log\",\n page={\n \"size\": 1\n },\n)" - lang: JavaScript source: "const response = await client.ml.getCategories({\n job_id: \"esxi_log\",\n page: {\n size: 1,\n },\n});" - lang: Ruby source: "response = client.ml.get_categories(\n job_id: \"esxi_log\",\n body: {\n \"page\": {\n \"size\": 1\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->getCategories([\n \"job_id\" => \"esxi_log\",\n \"body\" => [\n \"page\" => [\n \"size\" => 1,\n ],\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"page":{"size":1}}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/esxi_log/results/categories"' - lang: Java source: "client.ml().getCategories(g -> g\n .jobId(\"esxi_log\")\n .page(p -> p\n .size(1)\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}/_stats: get: tags: - ml anomaly summary: Get datafeed stats description: 'You can get statistics for multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can get statistics for all datafeeds by using `_all`, by specifying `*` as the ``, or by omitting the ``. If the datafeed is stopped, the only information you receive is the `datafeed_id` and the `state`. This API returns a maximum of 10,000 datafeeds.' operationId: ml-get-datafeed-stats parameters: - in: path name: datafeed_id description: 'Identifier for the datafeed. It can be a datafeed identifier or a wildcard expression. If you do not specify one of these options, the API returns information about all datafeeds.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Ids' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no datafeeds that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `datafeeds` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number datafeeds: type: array items: $ref: '#/components/schemas/ml._types.DatafeedStats' required: - count - datafeeds x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/datafeeds/{datafeed_id}/_stats\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_datafeed_stats.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_stats ' - lang: Python source: "resp = client.ml.get_datafeed_stats(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getDatafeedStats({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_datafeed_stats(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getDatafeedStats([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_stats"' - lang: Java source: "client.ml().getDatafeedStats(g -> g\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/_stats: get: tags: - ml anomaly summary: Get datafeed stats description: 'You can get statistics for multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can get statistics for all datafeeds by using `_all`, by specifying `*` as the ``, or by omitting the ``. If the datafeed is stopped, the only information you receive is the `datafeed_id` and the `state`. This API returns a maximum of 10,000 datafeeds.' operationId: ml-get-datafeed-stats-1 parameters: - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no datafeeds that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `datafeeds` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number datafeeds: type: array items: $ref: '#/components/schemas/ml._types.DatafeedStats' required: - count - datafeeds x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/datafeeds/_stats\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_datafeed_stats.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_stats ' - lang: Python source: "resp = client.ml.get_datafeed_stats(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getDatafeedStats({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_datafeed_stats(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getDatafeedStats([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_stats"' - lang: Java source: "client.ml().getDatafeedStats(g -> g\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds: get: tags: - ml anomaly summary: Get datafeeds configuration info description: 'You can get information for multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can get information for all datafeeds by using `_all`, by specifying `*` as the ``, or by omitting the ``. This API returns a maximum of 10,000 datafeeds.' operationId: ml-get-datafeeds-1 parameters: - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no datafeeds that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `datafeeds` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: exclude_generated description: 'Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number datafeeds: type: array items: $ref: '#/components/schemas/ml._types.Datafeed' required: - count - datafeeds x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/datafeeds\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_datafeeds.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales ' - lang: Python source: "resp = client.ml.get_datafeeds(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getDatafeeds({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_datafeeds(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getDatafeeds([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales"' - lang: Java source: "client.ml().getDatafeeds(g -> g\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/filters: get: tags: - ml anomaly summary: Get filters description: You can get a single filter or all filters. operationId: ml-get-filters parameters: - in: query name: from description: Skips the specified number of filters. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of filters to obtain. deprecated: false schema: type: number style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number filters: type: array items: $ref: '#/components/schemas/ml._types.Filter' required: - count - filters x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/filters\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: get_filters.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/filters/safe_domains ' - lang: Python source: "resp = client.ml.get_filters(\n filter_id=\"safe_domains\",\n)" - lang: JavaScript source: "const response = await client.ml.getFilters({\n filter_id: \"safe_domains\",\n});" - lang: Ruby source: "response = client.ml.get_filters(\n filter_id: \"safe_domains\"\n)" - lang: PHP source: "$resp = $client->ml()->getFilters([\n \"filter_id\" => \"safe_domains\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/filters/safe_domains"' - lang: Java source: "client.ml().getFilters(g -> g\n .filterId(\"safe_domains\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/influencers: get: tags: - ml anomaly summary: Get anomaly detection job results for influencers description: 'Influencers are the entities that have contributed to, or are to blame for, the anomalies. Influencer results are available only if an `influencer_field_name` is specified in the job configuration.' operationId: ml-get-influencers parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: 'If true, the output excludes interim results. By default, interim results are included.' deprecated: false schema: type: boolean style: form - in: query name: influencer_score description: 'Returns influencers with anomaly scores greater than or equal to this value.' deprecated: false schema: type: number style: form - in: query name: from description: Skips the specified number of influencers. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of influencers to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested influencers. By default, the influencers are sorted by the `influencer_score` value.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns influencers with timestamps after this time. The default value means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetInfluencersExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/results/influencers` request. value: "{\n \"sort\": \"influencer_score\",\n \"desc\": true\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number influencers: description: Array of influencer objects type: array items: $ref: '#/components/schemas/ml._types.Influencer' required: - count - influencers x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/influencers\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/influencers\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_influencers.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/results/influencers\n{\n \"sort\": \"influencer_score\",\n \"desc\": true\n}" - lang: Python source: "resp = client.ml.get_influencers(\n job_id=\"high_sum_total_sales\",\n sort=\"influencer_score\",\n desc=True,\n)" - lang: JavaScript source: "const response = await client.ml.getInfluencers({\n job_id: \"high_sum_total_sales\",\n sort: \"influencer_score\",\n desc: true,\n});" - lang: Ruby source: "response = client.ml.get_influencers(\n job_id: \"high_sum_total_sales\",\n body: {\n \"sort\": \"influencer_score\",\n \"desc\": true\n }\n)" - lang: PHP source: "$resp = $client->ml()->getInfluencers([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"sort\" => \"influencer_score\",\n \"desc\" => true,\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"sort":"influencer_score","desc":true}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/results/influencers"' - lang: Java source: "client.ml().getInfluencers(g -> g\n .jobId(\"high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly detection job results for influencers description: 'Influencers are the entities that have contributed to, or are to blame for, the anomalies. Influencer results are available only if an `influencer_field_name` is specified in the job configuration.' operationId: ml-get-influencers-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns influencers with timestamps earlier than this time. The default value means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: 'If true, the output excludes interim results. By default, interim results are included.' deprecated: false schema: type: boolean style: form - in: query name: influencer_score description: 'Returns influencers with anomaly scores greater than or equal to this value.' deprecated: false schema: type: number style: form - in: query name: from description: Skips the specified number of influencers. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of influencers to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested influencers. By default, the influencers are sorted by the `influencer_score` value.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns influencers with timestamps after this time. The default value means it is unset and results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: page: description: 'Configures pagination. This parameter has the `from` and `size` properties.' allOf: - $ref: '#/components/schemas/ml._types.Page' examples: MlGetInfluencersExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/results/influencers` request. value: "{\n \"sort\": \"influencer_score\",\n \"desc\": true\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number influencers: description: Array of influencer objects type: array items: $ref: '#/components/schemas/ml._types.Influencer' required: - count - influencers x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/influencers\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/influencers\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_influencers.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/results/influencers\n{\n \"sort\": \"influencer_score\",\n \"desc\": true\n}" - lang: Python source: "resp = client.ml.get_influencers(\n job_id=\"high_sum_total_sales\",\n sort=\"influencer_score\",\n desc=True,\n)" - lang: JavaScript source: "const response = await client.ml.getInfluencers({\n job_id: \"high_sum_total_sales\",\n sort: \"influencer_score\",\n desc: true,\n});" - lang: Ruby source: "response = client.ml.get_influencers(\n job_id: \"high_sum_total_sales\",\n body: {\n \"sort\": \"influencer_score\",\n \"desc\": true\n }\n)" - lang: PHP source: "$resp = $client->ml()->getInfluencers([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"sort\" => \"influencer_score\",\n \"desc\" => true,\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"sort":"influencer_score","desc":true}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/results/influencers"' - lang: Java source: "client.ml().getInfluencers(g -> g\n .jobId(\"high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/_stats: get: tags: - ml anomaly summary: Get anomaly detection job stats operationId: ml-get-job-stats parameters: - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the _all string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. If `true`, the API returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If `false`, the API returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number jobs: type: array items: $ref: '#/components/schemas/ml._types.JobStats' required: - count - jobs x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/_stats\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_job_stats.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/anomaly_detectors/low_request_rate/_stats ' - lang: Python source: "resp = client.ml.get_job_stats(\n job_id=\"low_request_rate\",\n)" - lang: JavaScript source: "const response = await client.ml.getJobStats({\n job_id: \"low_request_rate\",\n});" - lang: Ruby source: "response = client.ml.get_job_stats(\n job_id: \"low_request_rate\"\n)" - lang: PHP source: "$resp = $client->ml()->getJobStats([\n \"job_id\" => \"low_request_rate\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_stats"' - lang: Java source: "client.ml().getJobStats(g -> g\n .jobId(\"low_request_rate\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_stats: get: tags: - ml anomaly summary: Get anomaly detection job stats operationId: ml-get-job-stats-1 parameters: - in: path name: job_id description: 'Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs, or a wildcard expression. If you do not specify one of these options, the API returns information for all anomaly detection jobs.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the _all string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. If `true`, the API returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If `false`, the API returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number jobs: type: array items: $ref: '#/components/schemas/ml._types.JobStats' required: - count - jobs x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/_stats\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_job_stats.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/anomaly_detectors/low_request_rate/_stats ' - lang: Python source: "resp = client.ml.get_job_stats(\n job_id=\"low_request_rate\",\n)" - lang: JavaScript source: "const response = await client.ml.getJobStats({\n job_id: \"low_request_rate\",\n});" - lang: Ruby source: "response = client.ml.get_job_stats(\n job_id: \"low_request_rate\"\n)" - lang: PHP source: "$resp = $client->ml()->getJobStats([\n \"job_id\" => \"low_request_rate\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_stats"' - lang: Java source: "client.ml().getJobStats(g -> g\n .jobId(\"low_request_rate\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors: get: tags: - ml anomaly summary: Get anomaly detection jobs configuration info description: 'You can get information for multiple anomaly detection jobs in a single API request by using a group name, a comma-separated list of jobs, or a wildcard expression. You can get information for all anomaly detection jobs by using `_all`, by specifying `*` as the ``, or by omitting the ``.' operationId: ml-get-jobs-1 parameters: - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the _all string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. The default value is `true`, which returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: exclude_generated description: 'Indicates if certain fields should be removed from the configuration on retrieval. This allows the configuration to be in an acceptable format to be retrieved and then added to another cluster.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number jobs: type: array items: $ref: '#/components/schemas/ml._types.Job' required: - count - jobs x-state: Generally available; Added in 5.5.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_jobs.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/anomaly_detectors/high_sum_total_sales ' - lang: Python source: "resp = client.ml.get_jobs(\n job_id=\"high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.getJobs({\n job_id: \"high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.get_jobs(\n job_id: \"high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->getJobs([\n \"job_id\" => \"high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales"' - lang: Java source: "client.ml().getJobs(g -> g\n .jobId(\"high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_upgrade/_stats: get: tags: - ml anomaly summary: Get anomaly detection job model snapshot upgrade usage info operationId: ml-get-model-snapshot-upgrade-stats parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: 'A numerical character string that uniquely identifies the model snapshot. You can get information for multiple snapshots by using a comma-separated list or a wildcard expression. You can get all snapshots by using `_all`, by specifying `*` as the snapshot ID, or by omitting the snapshot ID.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: "Specifies what to do when the request:\n\n - Contains wildcard expressions and there are no jobs that match.\n - Contains the _all string or no identifiers and there are no matches.\n - Contains wildcard expressions and there are only partial matches.\n\nThe default value is true, which returns an empty jobs array when there are no matches and the subset of results\nwhen there are partial matches. If this parameter is false, the request returns a 404 status code when there are\nno matches or only partial matches." deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number model_snapshot_upgrades: type: array items: $ref: '#/components/schemas/ml._types.ModelSnapshotUpgrade' required: - count - model_snapshot_upgrades x-state: Generally available; Added in 7.16.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_upgrade/_stats\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_model_snapshot_upgrade_stats.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/anomaly_detectors/low_request_rate/model_snapshots/_all/_upgrade/_stats ' - lang: Python source: "resp = client.ml.get_model_snapshot_upgrade_stats(\n job_id=\"low_request_rate\",\n snapshot_id=\"_all\",\n)" - lang: JavaScript source: "const response = await client.ml.getModelSnapshotUpgradeStats({\n job_id: \"low_request_rate\",\n snapshot_id: \"_all\",\n});" - lang: Ruby source: "response = client.ml.get_model_snapshot_upgrade_stats(\n job_id: \"low_request_rate\",\n snapshot_id: \"_all\"\n)" - lang: PHP source: "$resp = $client->ml()->getModelSnapshotUpgradeStats([\n \"job_id\" => \"low_request_rate\",\n \"snapshot_id\" => \"_all\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/model_snapshots/_all/_upgrade/_stats"' - lang: Java source: "client.ml().getModelSnapshotUpgradeStats(g -> g\n .jobId(\"low_request_rate\")\n .snapshotId(\"_all\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots: get: tags: - ml anomaly summary: Get model snapshots info operationId: ml-get-model-snapshots-2 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: Returns snapshots with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: from description: Skips the specified number of snapshots. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of snapshots to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested snapshots. By default, the snapshots are sorted by their timestamp.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: Returns snapshots with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the description for the `sort` query parameter. allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetModelSnapshotsExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots` request. value: "{\n \"start\": \"1575402236000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number model_snapshots: type: array items: $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - count - model_snapshots x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/model_snapshots\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_model_snapshots.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots\n{\n \"start\": \"1575402236000\"\n}" - lang: Python source: "resp = client.ml.get_model_snapshots(\n job_id=\"high_sum_total_sales\",\n start=\"1575402236000\",\n)" - lang: JavaScript source: "const response = await client.ml.getModelSnapshots({\n job_id: \"high_sum_total_sales\",\n start: 1575402236000,\n});" - lang: Ruby source: "response = client.ml.get_model_snapshots(\n job_id: \"high_sum_total_sales\",\n body: {\n \"start\": \"1575402236000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getModelSnapshots([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"start\" => \"1575402236000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"start":"1575402236000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/model_snapshots"' - lang: Java source: "client.ml().getModelSnapshots(g -> g\n .jobId(\"high_sum_total_sales\")\n .start(DateTime.of(\"1575402236000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get model snapshots info operationId: ml-get-model-snapshots-3 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: Returns snapshots with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: from description: Skips the specified number of snapshots. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of snapshots to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: 'Specifies the sort field for the requested snapshots. By default, the snapshots are sorted by their timestamp.' deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: Returns snapshots with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' page: allOf: - $ref: '#/components/schemas/ml._types.Page' sort: description: Refer to the description for the `sort` query parameter. allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetModelSnapshotsExample1: description: An example body for a `GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots` request. value: "{\n \"start\": \"1575402236000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number model_snapshots: type: array items: $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - count - model_snapshots x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/model_snapshots\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_model_snapshots.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/high_sum_total_sales/model_snapshots\n{\n \"start\": \"1575402236000\"\n}" - lang: Python source: "resp = client.ml.get_model_snapshots(\n job_id=\"high_sum_total_sales\",\n start=\"1575402236000\",\n)" - lang: JavaScript source: "const response = await client.ml.getModelSnapshots({\n job_id: \"high_sum_total_sales\",\n start: 1575402236000,\n});" - lang: Ruby source: "response = client.ml.get_model_snapshots(\n job_id: \"high_sum_total_sales\",\n body: {\n \"start\": \"1575402236000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getModelSnapshots([\n \"job_id\" => \"high_sum_total_sales\",\n \"body\" => [\n \"start\" => \"1575402236000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"start":"1575402236000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/high_sum_total_sales/model_snapshots"' - lang: Java source: "client.ml().getModelSnapshots(g -> g\n .jobId(\"high_sum_total_sales\")\n .start(DateTime.of(\"1575402236000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/overall_buckets: get: tags: - ml anomaly summary: Get overall bucket results description: 'Retrievs overall bucket results that summarize the bucket results of multiple anomaly detection jobs. The `overall_score` is calculated by combining the scores of all the buckets within the overall bucket span. First, the maximum `anomaly_score` per anomaly detection job in the overall bucket is calculated. Then the `top_n` of those scores are averaged to result in the `overall_score`. This means that you can fine-tune the `overall_score` so that it is more or less sensitive to the number of jobs that detect an anomaly at the same time. For example, if you set `top_n` to `1`, the `overall_score` is the maximum bucket score in the overall bucket. Alternatively, if you set `top_n` to the number of jobs, the `overall_score` is high only when all jobs detect anomalies in that overall bucket. If you set the `bucket_span` parameter (to a value greater than its default), the `overall_score` is the maximum `overall_score` of the overall buckets that have a span equal to the jobs'' largest bucket span.' operationId: ml-get-overall-buckets parameters: - in: path name: job_id description: 'Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression. You can summarize the bucket results for all anomaly detection jobs by using `_all` or by specifying `*` as the ``.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. If `true`, the request returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: bucket_span description: 'The span of the overall buckets. Must be greater or equal to the largest bucket span of the specified anomaly detection jobs, which is the default value. By default, an overall bucket has a span equal to the largest bucket span of the specified anomaly detection jobs. To override that behavior, use the optional `bucket_span` parameter.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form - in: query name: end description: Returns overall buckets with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: overall_score description: 'Returns overall buckets with overall scores greater than or equal to this value.' deprecated: false schema: type: number style: form - in: query name: start description: Returns overall buckets with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: top_n description: 'The number of top anomaly detection job bucket scores to be used in the `overall_score` calculation.' deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: allow_no_match: description: Refer to the description for the `allow_no_match` query parameter. default: true type: boolean bucket_span: description: Refer to the description for the `bucket_span` query parameter. allOf: - $ref: '#/components/schemas/_types.Duration' end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean overall_score: description: Refer to the description for the `overall_score` query parameter. type: number start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' top_n: description: Refer to the description for the `top_n` query parameter. default: 1.0 type: number examples: MlGetOverallBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/job-*/results/overall_buckets` request. value: "{\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number overall_buckets: description: Array of overall bucket objects type: array items: $ref: '#/components/schemas/ml._types.OverallBucket' required: - count - overall_buckets x-state: Generally available; Added in 6.1.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/overall_buckets\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/overall_buckets\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_overall_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/job-*/results/overall_buckets\n{\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n}" - lang: Python source: "resp = client.ml.get_overall_buckets(\n job_id=\"job-*\",\n overall_score=80,\n start=\"1403532000000\",\n)" - lang: JavaScript source: "const response = await client.ml.getOverallBuckets({\n job_id: \"job-*\",\n overall_score: 80,\n start: 1403532000000,\n});" - lang: Ruby source: "response = client.ml.get_overall_buckets(\n job_id: \"job-*\",\n body: {\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getOverallBuckets([\n \"job_id\" => \"job-*\",\n \"body\" => [\n \"overall_score\" => 80,\n \"start\" => \"1403532000000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"overall_score":80,"start":"1403532000000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-*/results/overall_buckets"' - lang: Java source: "client.ml().getOverallBuckets(g -> g\n .jobId(\"job-*\")\n .overallScore(80.0D)\n .start(DateTime.of(\"1403532000000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get overall bucket results description: 'Retrievs overall bucket results that summarize the bucket results of multiple anomaly detection jobs. The `overall_score` is calculated by combining the scores of all the buckets within the overall bucket span. First, the maximum `anomaly_score` per anomaly detection job in the overall bucket is calculated. Then the `top_n` of those scores are averaged to result in the `overall_score`. This means that you can fine-tune the `overall_score` so that it is more or less sensitive to the number of jobs that detect an anomaly at the same time. For example, if you set `top_n` to `1`, the `overall_score` is the maximum bucket score in the overall bucket. Alternatively, if you set `top_n` to the number of jobs, the `overall_score` is high only when all jobs detect anomalies in that overall bucket. If you set the `bucket_span` parameter (to a value greater than its default), the `overall_score` is the maximum `overall_score` of the overall buckets that have a span equal to the jobs'' largest bucket span.' operationId: ml-get-overall-buckets-1 parameters: - in: path name: job_id description: 'Identifier for the anomaly detection job. It can be a job identifier, a group name, a comma-separated list of jobs or groups, or a wildcard expression. You can summarize the bucket results for all anomaly detection jobs by using `_all` or by specifying `*` as the ``.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: 1. Contains wildcard expressions and there are no jobs that match. 2. Contains the `_all` string or no identifiers and there are no matches. 3. Contains wildcard expressions and there are only partial matches. If `true`, the request returns an empty `jobs` array when there are no matches and the subset of results when there are partial matches. If this parameter is `false`, the request returns a `404` status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: bucket_span description: 'The span of the overall buckets. Must be greater or equal to the largest bucket span of the specified anomaly detection jobs, which is the default value. By default, an overall bucket has a span equal to the largest bucket span of the specified anomaly detection jobs. To override that behavior, use the optional `bucket_span` parameter.' deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form - in: query name: end description: Returns overall buckets with timestamps earlier than this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: overall_score description: 'Returns overall buckets with overall scores greater than or equal to this value.' deprecated: false schema: type: number style: form - in: query name: start description: Returns overall buckets with timestamps after this time. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: top_n description: 'The number of top anomaly detection job bucket scores to be used in the `overall_score` calculation.' deprecated: false schema: type: number style: form requestBody: content: application/json: schema: type: object properties: allow_no_match: description: Refer to the description for the `allow_no_match` query parameter. default: true type: boolean bucket_span: description: Refer to the description for the `bucket_span` query parameter. allOf: - $ref: '#/components/schemas/_types.Duration' end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean overall_score: description: Refer to the description for the `overall_score` query parameter. type: number start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' top_n: description: Refer to the description for the `top_n` query parameter. default: 1.0 type: number examples: MlGetOverallBucketsExample1: description: An example body for a `GET _ml/anomaly_detectors/job-*/results/overall_buckets` request. value: "{\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number overall_buckets: description: Array of overall bucket objects type: array items: $ref: '#/components/schemas/ml._types.OverallBucket' required: - count - overall_buckets x-state: Generally available; Added in 6.1.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/overall_buckets\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/overall_buckets\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_overall_buckets.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/job-*/results/overall_buckets\n{\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n}" - lang: Python source: "resp = client.ml.get_overall_buckets(\n job_id=\"job-*\",\n overall_score=80,\n start=\"1403532000000\",\n)" - lang: JavaScript source: "const response = await client.ml.getOverallBuckets({\n job_id: \"job-*\",\n overall_score: 80,\n start: 1403532000000,\n});" - lang: Ruby source: "response = client.ml.get_overall_buckets(\n job_id: \"job-*\",\n body: {\n \"overall_score\": 80,\n \"start\": \"1403532000000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getOverallBuckets([\n \"job_id\" => \"job-*\",\n \"body\" => [\n \"overall_score\" => 80,\n \"start\" => \"1403532000000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"overall_score":80,"start":"1403532000000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-*/results/overall_buckets"' - lang: Java source: "client.ml().getOverallBuckets(g -> g\n .jobId(\"job-*\")\n .overallScore(80.0D)\n .start(DateTime.of(\"1403532000000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/results/records: get: tags: - ml anomaly summary: Get anomaly records for an anomaly detection job description: 'Records contain the detailed analytical results. They describe the anomalous activity that has been identified in the input data based on the detector configuration. There can be many anomaly records depending on the characteristics and size of the input data. In practice, there are often too many to be able to manually process them. The machine learning features therefore perform a sophisticated aggregation of the anomaly records into buckets. The number of record results depends on the number of anomalies found in each bucket, which relates to the number of time series being modeled and the number of detectors.' operationId: ml-get-records parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns records with timestamps earlier than this time. The default value means results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of records. deprecated: false schema: type: number style: form - in: query name: record_score description: Returns records with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of records to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested records. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns records with timestamps after this time. The default value means results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' record_score: description: Refer to the description for the `record_score` query parameter. default: 0.0 type: number sort: description: Refer to the description for the `sort` query parameter. default: record_score allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetRecordsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/records` request. value: "{\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number records: type: array items: $ref: '#/components/schemas/ml._types.Anomaly' required: - count - records x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/records\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/records\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_records.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/records\n{\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n}" - lang: Python source: "resp = client.ml.get_records(\n job_id=\"low_request_rate\",\n sort=\"record_score\",\n desc=True,\n start=\"1454944100000\",\n)" - lang: JavaScript source: "const response = await client.ml.getRecords({\n job_id: \"low_request_rate\",\n sort: \"record_score\",\n desc: true,\n start: 1454944100000,\n});" - lang: Ruby source: "response = client.ml.get_records(\n job_id: \"low_request_rate\",\n body: {\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getRecords([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"sort\" => \"record_score\",\n \"desc\" => true,\n \"start\" => \"1454944100000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"sort":"record_score","desc":true,"start":"1454944100000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/records"' - lang: Java source: "client.ml().getRecords(g -> g\n .desc(true)\n .jobId(\"low_request_rate\")\n .sort(\"record_score\")\n .start(DateTime.of(\"1454944100000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Get anomaly records for an anomaly detection job description: 'Records contain the detailed analytical results. They describe the anomalous activity that has been identified in the input data based on the detector configuration. There can be many anomaly records depending on the characteristics and size of the input data. In practice, there are often too many to be able to manually process them. The machine learning features therefore perform a sophisticated aggregation of the anomaly records into buckets. The number of record results depends on the number of anomalies found in each bucket, which relates to the number of time series being modeled and the number of detectors.' operationId: ml-get-records-1 parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: desc description: If true, the results are sorted in descending order. deprecated: false schema: type: boolean style: form - in: query name: end description: 'Returns records with timestamps earlier than this time. The default value means results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: exclude_interim description: If `true`, the output excludes interim results. deprecated: false schema: type: boolean style: form - in: query name: from description: Skips the specified number of records. deprecated: false schema: type: number style: form - in: query name: record_score description: Returns records with anomaly scores greater or equal than this value. deprecated: false schema: type: number style: form - in: query name: size description: Specifies the maximum number of records to obtain. deprecated: false schema: type: number style: form - in: query name: sort description: Specifies the sort field for the requested records. deprecated: false schema: $ref: '#/components/schemas/_types.Field' style: form - in: query name: start description: 'Returns records with timestamps after this time. The default value means results are not limited to specific timestamps.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: desc: description: Refer to the description for the `desc` query parameter. default: false type: boolean end: description: Refer to the description for the `end` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' exclude_interim: description: Refer to the description for the `exclude_interim` query parameter. default: false type: boolean page: allOf: - $ref: '#/components/schemas/ml._types.Page' record_score: description: Refer to the description for the `record_score` query parameter. default: 0.0 type: number sort: description: Refer to the description for the `sort` query parameter. default: record_score allOf: - $ref: '#/components/schemas/_types.Field' start: description: Refer to the description for the `start` query parameter. default: '-1' allOf: - $ref: '#/components/schemas/_types.DateTime' examples: MlGetRecordsExample1: description: An example body for a `GET _ml/anomaly_detectors/low_request_rate/results/records` request. value: "{\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: count: type: number records: type: array items: $ref: '#/components/schemas/ml._types.Anomaly' required: - count - records x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/anomaly_detectors/{job_id}/results/records\n
\n " - "
\n POST\n /_ml/anomaly_detectors/{job_id}/results/records\n
\n " x-req-auth: - 'Cluster privileges: `monitor_ml` ' x-api: get_records.ml x-category: ai/ml x-codeSamples: - lang: Console source: "GET _ml/anomaly_detectors/low_request_rate/results/records\n{\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n}" - lang: Python source: "resp = client.ml.get_records(\n job_id=\"low_request_rate\",\n sort=\"record_score\",\n desc=True,\n start=\"1454944100000\",\n)" - lang: JavaScript source: "const response = await client.ml.getRecords({\n job_id: \"low_request_rate\",\n sort: \"record_score\",\n desc: true,\n start: 1454944100000,\n});" - lang: Ruby source: "response = client.ml.get_records(\n job_id: \"low_request_rate\",\n body: {\n \"sort\": \"record_score\",\n \"desc\": true,\n \"start\": \"1454944100000\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->getRecords([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"sort\" => \"record_score\",\n \"desc\" => true,\n \"start\" => \"1454944100000\",\n ],\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"sort":"record_score","desc":true,"start":"1454944100000"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/records"' - lang: Java source: "client.ml().getRecords(g -> g\n .desc(true)\n .jobId(\"low_request_rate\")\n .sort(\"record_score\")\n .start(DateTime.of(\"1454944100000\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_open: post: tags: - ml anomaly summary: Open anomaly detection jobs description: 'An anomaly detection job must be opened to be ready to receive and analyze data. It can be opened and closed multiple times throughout its lifecycle. When you open a new job, it starts with an empty model. When you open an existing job, the most recent model state is automatically loaded. The job is ready to resume its analysis from where it left off, once new data is received.' operationId: ml-open-job parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: timeout description: Controls the time to wait until a job has opened. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: timeout: description: Refer to the description for the `timeout` query parameter. default: 30m allOf: - $ref: '#/components/schemas/_types.Duration' examples: MlOpenJobRequestExample1: description: 'A request to open anomaly detection jobs. The timeout specifies to wait 35 minutes for the job to open. ' value: "{\n \"timeout\": \"35m\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: opened: type: boolean node: description: 'The ID of the node that the job was started on. In serverless this will be the "serverless". If the job is allowed to open lazily and has not yet been assigned to a node, this value is an empty string.' allOf: - $ref: '#/components/schemas/_types.NodeId' required: - opened - node examples: MlOpenJobResponseExample1: description: A successful response when opening an anomaly detection job. value: "{\n \"opened\": true,\n \"node\": \"node-1\"\n}" x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_open\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: open_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST /_ml/anomaly_detectors/job-01/_open\n{\n \"timeout\": \"35m\"\n}" - lang: Python source: "resp = client.ml.open_job(\n job_id=\"job-01\",\n timeout=\"35m\",\n)" - lang: JavaScript source: "const response = await client.ml.openJob({\n job_id: \"job-01\",\n timeout: \"35m\",\n});" - lang: Ruby source: "response = client.ml.open_job(\n job_id: \"job-01\",\n body: {\n \"timeout\": \"35m\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->openJob([\n \"job_id\" => \"job-01\",\n \"body\" => [\n \"timeout\" => \"35m\",\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"timeout":"35m"}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/job-01/_open"' - lang: Java source: "client.ml().openJob(o -> o\n .jobId(\"job-01\")\n .timeout(t -> t\n .time(\"35m\")\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_data: post: tags: - ml anomaly summary: Send data to an anomaly detection job for analysis description: 'IMPORTANT: For each job, data can be accepted from only a single connection at a time. It is not currently possible to post data to multiple jobs using wildcards or a comma-separated list.' operationId: ml-post-data parameters: - in: path name: job_id description: Identifier for the anomaly detection job. The job must have a state of open to receive and process the data. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: reset_end description: Specifies the end of the bucket resetting range. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: reset_start description: Specifies the start of the bucket resetting range. deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: array items: type: object required: true responses: '200': description: '' content: application/json: schema: type: object properties: job_id: allOf: - $ref: '#/components/schemas/_types.Id' processed_record_count: type: number processed_field_count: type: number input_bytes: type: number input_field_count: type: number invalid_date_count: type: number missing_field_count: type: number out_of_order_timestamp_count: type: number empty_bucket_count: type: number sparse_bucket_count: type: number bucket_count: type: number earliest_record_timestamp: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' latest_record_timestamp: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' last_data_time: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' latest_empty_bucket_timestamp: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' latest_sparse_bucket_timestamp: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' input_record_count: type: number log_time: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' required: - job_id - processed_record_count - processed_field_count - input_bytes - input_field_count - invalid_date_count - missing_field_count - out_of_order_timestamp_count - empty_bucket_count - sparse_bucket_count - bucket_count - input_record_count deprecated: true x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_data\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: post_data.ml x-category: ai/ml x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}/_preview: get: tags: - ml anomaly summary: Preview a datafeed description: 'This API returns the first "page" of search results from a datafeed. You can preview an existing datafeed or provide configuration details for a datafeed and anomaly detection job in the API. The preview shows the structure of the data that will be passed to the anomaly detection engine. IMPORTANT: When Elasticsearch security features are enabled, the preview uses the credentials of the user that called the API. However, when the datafeed starts it uses the roles of the last user that created or updated the datafeed. To get a preview that accurately reflects the behavior of the datafeed, use the appropriate credentials. You can also use secondary authorization headers to supply the credentials.' operationId: ml-preview-datafeed parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters. NOTE: If you use this path parameter, you cannot provide datafeed or anomaly detection job configuration details in the request body.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: start description: The start time from where the datafeed preview should begin deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: end description: The end time when the datafeed preview should stop deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: datafeed_config: description: The datafeed definition to preview. allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' job_config: description: 'The configuration details for the anomaly detection job that is associated with the datafeed. If the `datafeed_config` object does not include a `job_id` that references an existing anomaly detection job, you must supply this `job_config` object. If you include both a `job_id` and a `job_config`, the latter information is used. You cannot specify a `job_config` object unless you also supply a `datafeed_config` object.' allOf: - $ref: '#/components/schemas/ml._types.JobConfig' responses: '200': description: '' content: application/json: schema: type: array items: type: object x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/datafeeds/{datafeed_id}/_preview\n
\n " - "
\n POST\n /_ml/datafeeds/{datafeed_id}/_preview\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: preview_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_preview ' - lang: Python source: "resp = client.ml.preview_datafeed(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.previewDatafeed({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.preview_datafeed(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->previewDatafeed([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_preview"' - lang: Java source: "client.ml().previewDatafeed(p -> p\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Preview a datafeed description: 'This API returns the first "page" of search results from a datafeed. You can preview an existing datafeed or provide configuration details for a datafeed and anomaly detection job in the API. The preview shows the structure of the data that will be passed to the anomaly detection engine. IMPORTANT: When Elasticsearch security features are enabled, the preview uses the credentials of the user that called the API. However, when the datafeed starts it uses the roles of the last user that created or updated the datafeed. To get a preview that accurately reflects the behavior of the datafeed, use the appropriate credentials. You can also use secondary authorization headers to supply the credentials.' operationId: ml-preview-datafeed-1 parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters. NOTE: If you use this path parameter, you cannot provide datafeed or anomaly detection job configuration details in the request body.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: start description: The start time from where the datafeed preview should begin deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: end description: The end time when the datafeed preview should stop deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: datafeed_config: description: The datafeed definition to preview. allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' job_config: description: 'The configuration details for the anomaly detection job that is associated with the datafeed. If the `datafeed_config` object does not include a `job_id` that references an existing anomaly detection job, you must supply this `job_config` object. If you include both a `job_id` and a `job_config`, the latter information is used. You cannot specify a `job_config` object unless you also supply a `datafeed_config` object.' allOf: - $ref: '#/components/schemas/ml._types.JobConfig' responses: '200': description: '' content: application/json: schema: type: array items: type: object x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/datafeeds/{datafeed_id}/_preview\n
\n " - "
\n POST\n /_ml/datafeeds/{datafeed_id}/_preview\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: preview_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_preview ' - lang: Python source: "resp = client.ml.preview_datafeed(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.previewDatafeed({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.preview_datafeed(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->previewDatafeed([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_preview"' - lang: Java source: "client.ml().previewDatafeed(p -> p\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/_preview: get: tags: - ml anomaly summary: Preview a datafeed description: 'This API returns the first "page" of search results from a datafeed. You can preview an existing datafeed or provide configuration details for a datafeed and anomaly detection job in the API. The preview shows the structure of the data that will be passed to the anomaly detection engine. IMPORTANT: When Elasticsearch security features are enabled, the preview uses the credentials of the user that called the API. However, when the datafeed starts it uses the roles of the last user that created or updated the datafeed. To get a preview that accurately reflects the behavior of the datafeed, use the appropriate credentials. You can also use secondary authorization headers to supply the credentials.' operationId: ml-preview-datafeed-2 parameters: - in: query name: start description: The start time from where the datafeed preview should begin deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: end description: The end time when the datafeed preview should stop deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: datafeed_config: description: The datafeed definition to preview. allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' job_config: description: 'The configuration details for the anomaly detection job that is associated with the datafeed. If the `datafeed_config` object does not include a `job_id` that references an existing anomaly detection job, you must supply this `job_config` object. If you include both a `job_id` and a `job_config`, the latter information is used. You cannot specify a `job_config` object unless you also supply a `datafeed_config` object.' allOf: - $ref: '#/components/schemas/ml._types.JobConfig' responses: '200': description: '' content: application/json: schema: type: array items: type: object x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/datafeeds/_preview\n
\n " - "
\n POST\n /_ml/datafeeds/_preview\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: preview_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_preview ' - lang: Python source: "resp = client.ml.preview_datafeed(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.previewDatafeed({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.preview_datafeed(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->previewDatafeed([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_preview"' - lang: Java source: "client.ml().previewDatafeed(p -> p\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name post: tags: - ml anomaly summary: Preview a datafeed description: 'This API returns the first "page" of search results from a datafeed. You can preview an existing datafeed or provide configuration details for a datafeed and anomaly detection job in the API. The preview shows the structure of the data that will be passed to the anomaly detection engine. IMPORTANT: When Elasticsearch security features are enabled, the preview uses the credentials of the user that called the API. However, when the datafeed starts it uses the roles of the last user that created or updated the datafeed. To get a preview that accurately reflects the behavior of the datafeed, use the appropriate credentials. You can also use secondary authorization headers to supply the credentials.' operationId: ml-preview-datafeed-3 parameters: - in: query name: start description: The start time from where the datafeed preview should begin deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: end description: The end time when the datafeed preview should stop deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form requestBody: content: application/json: schema: type: object properties: datafeed_config: description: The datafeed definition to preview. allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' job_config: description: 'The configuration details for the anomaly detection job that is associated with the datafeed. If the `datafeed_config` object does not include a `job_id` that references an existing anomaly detection job, you must supply this `job_config` object. If you include both a `job_id` and a `job_config`, the latter information is used. You cannot specify a `job_config` object unless you also supply a `datafeed_config` object.' allOf: - $ref: '#/components/schemas/ml._types.JobConfig' responses: '200': description: '' content: application/json: schema: type: array items: type: object x-state: Generally available; Added in 5.4.0 x-variations: - "
\n GET\n /_ml/datafeeds/_preview\n
\n " - "
\n POST\n /_ml/datafeeds/_preview\n
\n " x-req-auth: - 'Index privileges: `read` ' - 'Cluster privileges: `manage_ml` ' x-api: preview_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'GET _ml/datafeeds/datafeed-high_sum_total_sales/_preview ' - lang: Python source: "resp = client.ml.preview_datafeed(\n datafeed_id=\"datafeed-high_sum_total_sales\",\n)" - lang: JavaScript source: "const response = await client.ml.previewDatafeed({\n datafeed_id: \"datafeed-high_sum_total_sales\",\n});" - lang: Ruby source: "response = client.ml.preview_datafeed(\n datafeed_id: \"datafeed-high_sum_total_sales\"\n)" - lang: PHP source: "$resp = $client->ml()->previewDatafeed([\n \"datafeed_id\" => \"datafeed-high_sum_total_sales\",\n]);" - lang: curl source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-high_sum_total_sales/_preview"' - lang: Java source: "client.ml().previewDatafeed(p -> p\n .datafeedId(\"datafeed-high_sum_total_sales\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_reset: post: tags: - ml anomaly summary: Reset an anomaly detection job description: 'All model state and results are deleted. The job is ready to start over as if it had just been created. It is not currently possible to reset multiple jobs using wildcards or a comma separated list.' operationId: ml-reset-job parameters: - in: path name: job_id description: The ID of the job to reset. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: wait_for_completion description: 'Should this request wait until the operation has completed before returning.' deprecated: false schema: type: boolean style: form - in: query name: delete_user_annotations description: 'Specifies whether annotations that have been added by the user should be deleted along with any auto-generated annotations when the job is reset.' deprecated: false schema: type: boolean style: form responses: '200': description: '' content: application/json: schema: $ref: '#/components/schemas/_types.AcknowledgedResponseBase' x-state: Generally available; Added in 7.14.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_reset\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: reset_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'POST _ml/anomaly_detectors/total-requests/_reset ' - lang: Python source: "resp = client.ml.reset_job(\n job_id=\"total-requests\",\n)" - lang: JavaScript source: "const response = await client.ml.resetJob({\n job_id: \"total-requests\",\n});" - lang: Ruby source: "response = client.ml.reset_job(\n job_id: \"total-requests\"\n)" - lang: PHP source: "$resp = $client->ml()->resetJob([\n \"job_id\" => \"total-requests\",\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/total-requests/_reset"' - lang: Java source: "client.ml().resetJob(r -> r\n .jobId(\"total-requests\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_revert: post: tags: - ml anomaly summary: Revert to a snapshot description: 'The machine learning features react quickly to anomalous input, learning new behaviors in data. Highly anomalous input increases the variance in the models whilst the system learns whether this is a new step-change in behavior or a one-off event. In the case where this anomalous input is known to be a one-off, then it might be appropriate to reset the model state to a time before this event. For example, you might consider reverting to a saved snapshot after Black Friday or a critical system failure.' operationId: ml-revert-model-snapshot parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: 'You can specify `empty` as the . Reverting to the empty snapshot means the anomaly detection job starts learning a new model from scratch when it is started.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: delete_intervening_results description: 'If true, deletes the results in the time period between the latest results and the time of the reverted snapshot. It also resets the model to accept records for this time period. If you choose not to delete intervening results when reverting a snapshot, the job will not accept input data that is older than the current time. If you want to resend data, then delete the intervening results.' deprecated: false schema: type: boolean style: form requestBody: content: application/json: schema: type: object properties: delete_intervening_results: description: Refer to the description for the `delete_intervening_results` query parameter. default: false type: boolean examples: MlRevertModelSnapshotExample1: description: An example body for a `POST _ml/anomaly_detectors/low_request_rate/model_snapshots/1637092688/_revert` request. value: "{\n \"delete_intervening_results\": true\n}" responses: '200': description: '' content: application/json: schema: type: object properties: model: allOf: - $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - model x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_revert\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: revert_model_snapshot.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/anomaly_detectors/low_request_rate/model_snapshots/1637092688/_revert\n{\n \"delete_intervening_results\": true\n}" - lang: Python source: "resp = client.ml.revert_model_snapshot(\n job_id=\"low_request_rate\",\n snapshot_id=\"1637092688\",\n delete_intervening_results=True,\n)" - lang: JavaScript source: "const response = await client.ml.revertModelSnapshot({\n job_id: \"low_request_rate\",\n snapshot_id: 1637092688,\n delete_intervening_results: true,\n});" - lang: Ruby source: "response = client.ml.revert_model_snapshot(\n job_id: \"low_request_rate\",\n snapshot_id: \"1637092688\",\n body: {\n \"delete_intervening_results\": true\n }\n)" - lang: PHP source: "$resp = $client->ml()->revertModelSnapshot([\n \"job_id\" => \"low_request_rate\",\n \"snapshot_id\" => \"1637092688\",\n \"body\" => [\n \"delete_intervening_results\" => true,\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"delete_intervening_results":true}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/model_snapshots/1637092688/_revert"' - lang: Java source: "client.ml().revertModelSnapshot(r -> r\n .deleteInterveningResults(true)\n .jobId(\"low_request_rate\")\n .snapshotId(\"1637092688\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}/_start: post: tags: - ml anomaly summary: Start datafeeds description: 'A datafeed must be started in order to retrieve data from Elasticsearch. A datafeed can be started and stopped multiple times throughout its lifecycle. Before you can start a datafeed, the anomaly detection job must be open. Otherwise, an error occurs. If you restart a stopped datafeed, it continues processing input data from the next millisecond after it was stopped. If new data was indexed for that exact millisecond between stopping and starting, it will be ignored. When Elasticsearch security features are enabled, your datafeed remembers which roles the last user to create or update it had at the time of creation or update and runs the query using those same roles. If you provided secondary authorization headers when you created or updated the datafeed, those credentials are used instead.' operationId: ml-start-datafeed parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: end description: 'The time that the datafeed should end, which can be specified by using one of the following formats: * ISO 8601 format with milliseconds, for example `2017-01-22T06:00:00.000Z` * ISO 8601 format without milliseconds, for example `2017-01-22T06:00:00+00:00` * Milliseconds since the epoch, for example `1485061200000` Date-time arguments using either of the ISO 8601 formats must have a time zone designator, where `Z` is accepted as an abbreviation for UTC time. When a URL is expected (for example, in browsers), the `+` used in time zone designators must be encoded as `%2B`. The end time value is exclusive. If you do not specify an end time, the datafeed runs continuously.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: start description: 'The time that the datafeed should begin, which can be specified by using the same formats as the `end` parameter. This value is inclusive. If you do not specify a start time and the datafeed is associated with a new anomaly detection job, the analysis starts from the earliest time for which data is available. If you restart a stopped datafeed and specify a start value that is earlier than the timestamp of the latest processed record, the datafeed continues from 1 millisecond after the timestamp of the latest processed record.' deprecated: false schema: $ref: '#/components/schemas/_types.DateTime' style: form - in: query name: timeout description: Specifies the amount of time to wait until a datafeed starts. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form requestBody: content: application/json: schema: type: object properties: end: description: Refer to the description for the `end` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' start: description: Refer to the description for the `start` query parameter. allOf: - $ref: '#/components/schemas/_types.DateTime' timeout: description: Refer to the description for the `timeout` query parameter. default: 20s allOf: - $ref: '#/components/schemas/_types.Duration' examples: MlStartDatafeedExample1: description: An example body for a `POST _ml/datafeeds/datafeed-low_request_rate/_start` request. value: "{\n \"start\": \"2019-04-07T18:22:16Z\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: node: description: 'The ID of the node that the job was started on. In serverless this will be the "serverless". If the job is allowed to open lazily and has not yet been assigned to a node, this value is an empty string.' allOf: - $ref: '#/components/schemas/_types.NodeIds' started: description: For a successful response, this value is always `true`. On failure, an exception is returned instead. type: boolean required: - node - started x-state: Generally available; Added in 5.5.0 x-variations: - "
\n POST\n /_ml/datafeeds/{datafeed_id}/_start\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: start_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/datafeeds/datafeed-low_request_rate/_start\n{\n \"start\": \"2019-04-07T18:22:16Z\"\n}" - lang: Python source: "resp = client.ml.start_datafeed(\n datafeed_id=\"datafeed-low_request_rate\",\n start=\"2019-04-07T18:22:16Z\",\n)" - lang: JavaScript source: "const response = await client.ml.startDatafeed({\n datafeed_id: \"datafeed-low_request_rate\",\n start: \"2019-04-07T18:22:16Z\",\n});" - lang: Ruby source: "response = client.ml.start_datafeed(\n datafeed_id: \"datafeed-low_request_rate\",\n body: {\n \"start\": \"2019-04-07T18:22:16Z\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->startDatafeed([\n \"datafeed_id\" => \"datafeed-low_request_rate\",\n \"body\" => [\n \"start\" => \"2019-04-07T18:22:16Z\",\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"start":"2019-04-07T18:22:16Z"}'' "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-low_request_rate/_start"' - lang: Java source: "client.ml().startDatafeed(s -> s\n .datafeedId(\"datafeed-low_request_rate\")\n .start(DateTime.of(\"2019-04-07T18:22:16Z\"))\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}/_stop: post: tags: - ml anomaly summary: Stop datafeeds description: 'A datafeed that is stopped ceases to retrieve data from Elasticsearch. A datafeed can be started and stopped multiple times throughout its lifecycle.' operationId: ml-stop-datafeed parameters: - in: path name: datafeed_id description: 'Identifier for the datafeed. You can stop multiple datafeeds in a single API request by using a comma-separated list of datafeeds or a wildcard expression. You can close all datafeeds by using `_all` or by specifying `*` as the identifier.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_match description: 'Specifies what to do when the request: * Contains wildcard expressions and there are no datafeeds that match. * Contains the `_all` string or no identifiers and there are no matches. * Contains wildcard expressions and there are only partial matches. If `true`, the API returns an empty datafeeds array when there are no matches and the subset of results when there are partial matches. If `false`, the API returns a 404 status code when there are no matches or only partial matches.' deprecated: false schema: type: boolean style: form - in: query name: force description: If `true`, the datafeed is stopped forcefully. deprecated: false schema: type: boolean style: form - in: query name: timeout description: Specifies the amount of time to wait until a datafeed stops. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form - in: query name: close_job description: If `true` the job associated with the datafeed is closed. deprecated: false schema: type: boolean style: form requestBody: content: application/json: schema: type: object properties: allow_no_match: description: Refer to the description for the `allow_no_match` query parameter. default: true type: boolean force: description: Refer to the description for the `force` query parameter. default: false type: boolean timeout: description: Refer to the description for the `timeout` query parameter. default: 20s allOf: - $ref: '#/components/schemas/_types.Duration' close_job: description: Refer to the description for the `close_job` query parameter. default: false type: boolean examples: MlStopDatafeedExample1: description: An example body for a `POST _ml/datafeeds/datafeed-low_request_rate/_stop` request. value: "{\n \"timeout\": \"30s\"\n}" responses: '200': description: '' content: application/json: schema: type: object properties: stopped: type: boolean required: - stopped x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/datafeeds/{datafeed_id}/_stop\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: stop_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/datafeeds/datafeed-low_request_rate/_stop\n{\n \"timeout\": \"30s\"\n}" - lang: Python source: "resp = client.ml.stop_datafeed(\n datafeed_id=\"datafeed-low_request_rate\",\n timeout=\"30s\",\n)" - lang: JavaScript source: "const response = await client.ml.stopDatafeed({\n datafeed_id: \"datafeed-low_request_rate\",\n timeout: \"30s\",\n});" - lang: Ruby source: "response = client.ml.stop_datafeed(\n datafeed_id: \"datafeed-low_request_rate\",\n body: {\n \"timeout\": \"30s\"\n }\n)" - lang: PHP source: "$resp = $client->ml()->stopDatafeed([\n \"datafeed_id\" => \"datafeed-low_request_rate\",\n \"body\" => [\n \"timeout\" => \"30s\",\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"timeout":"30s"}'' "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-low_request_rate/_stop"' - lang: Java source: "client.ml().stopDatafeed(s -> s\n .datafeedId(\"datafeed-low_request_rate\")\n .timeout(t -> t\n .time(\"30s\")\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/datafeeds/{datafeed_id}/_update: post: tags: - ml anomaly summary: Update a datafeed description: 'You must stop and start the datafeed for the changes to be applied. When Elasticsearch security features are enabled, your datafeed remembers which roles the user who updated it had at the time of the update and runs the query using those same roles. If you provide secondary authorization headers, those credentials are used instead.' operationId: ml-update-datafeed parameters: - in: path name: datafeed_id description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: allow_no_indices description: 'If `true`, wildcard indices expressions that resolve into no concrete indices are ignored. This includes the `_all` string or when no indices are specified.' deprecated: false schema: type: boolean style: form - in: query name: expand_wildcards description: "Type of index that wildcard patterns can match. If the request can target data streams, this argument determines\nwhether wildcard expressions match hidden data streams. Supports comma-separated values.\n\nSupported values include:\n - `all`: Match any data stream or index, including hidden ones.\n - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream.\n - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.\n - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`.\n - `none`: Wildcard expressions are not accepted.\n\n" deprecated: false schema: $ref: '#/components/schemas/_types.ExpandWildcards' style: form - in: query name: ignore_throttled description: If `true`, concrete, expanded or aliased indices are ignored when frozen. deprecated: true schema: type: boolean style: form - in: query name: ignore_unavailable description: If `true`, unavailable indices (missing or closed) are ignored. deprecated: false schema: type: boolean style: form requestBody: content: application/json: schema: type: object properties: aggregations: description: 'If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data.' type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' chunking_config: description: 'Datafeeds might search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated; it is an advanced configuration option.' allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' delayed_data_check_config: description: 'Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the `query_delay` is set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds.' allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' frequency: description: 'The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. When `frequency` is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.' allOf: - $ref: '#/components/schemas/_types.Duration' indices: description: 'An array of index names. Wildcards are supported. If any of the indices are in remote clusters, the machine learning nodes must have the `remote_cluster_client` role.' type: array items: type: string indices_options: description: Specifies index expansion options that are used during search. allOf: - $ref: '#/components/schemas/_types.IndicesOptions' job_id: allOf: - $ref: '#/components/schemas/_types.Id' max_empty_searches: description: 'If a real-time datafeed has never seen any data (including during any initial training period), it automatically stops and closes the associated job after this many real-time searches return no documents. In other words, it stops after `frequency` times `max_empty_searches` of real-time operation. If not set, a datafeed with no end time that sees no data remains started until it is explicitly stopped. By default, it is not set.' type: number query: description: 'The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. Note that if you change the query, the analyzed data is also changed. Therefore, the time required to learn might be long and the understandability of the results is unpredictable. If you want to make significant changes to the source data, it is recommended that you clone the job and datafeed and make the amendments in the clone. Let both run in parallel and close one when you are satisfied with the results of the job.' default: '{"match_all": {"boost": 1}}' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: description: 'The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between `60s` and `120s`. This randomness improves the query performance when there are multiple jobs running on the same node.' allOf: - $ref: '#/components/schemas/_types.Duration' runtime_mappings: description: Specifies runtime fields for the datafeed search. allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' script_fields: description: 'Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields.' type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: description: 'The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of `index.max_result_window`.' default: 1000.0 type: number examples: MlUpdateDatafeedExample1: description: An example body for a `POST _ml/datafeeds/datafeed-test-job/_update` request. value: "{\n \"query\": {\n \"term\": {\n \"geo.src\": \"US\"\n }\n }\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: authorization: allOf: - $ref: '#/components/schemas/ml._types.DatafeedAuthorization' aggregations: type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' chunking_config: allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' delayed_data_check_config: allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' datafeed_id: allOf: - $ref: '#/components/schemas/_types.Id' frequency: description: 'The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: `150s`. When `frequency` is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.' allOf: - $ref: '#/components/schemas/_types.Duration' indices: type: array items: type: string indices_options: allOf: - $ref: '#/components/schemas/_types.IndicesOptions' job_id: allOf: - $ref: '#/components/schemas/_types.Id' max_empty_searches: type: number query: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: allOf: - $ref: '#/components/schemas/_types.Duration' runtime_mappings: allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' script_fields: type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: type: number required: - chunking_config - datafeed_id - indices - job_id - query - query_delay - scroll_size x-state: Generally available; Added in 6.4.0 x-variations: - "
\n POST\n /_ml/datafeeds/{datafeed_id}/_update\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: update_datafeed.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/datafeeds/datafeed-test-job/_update\n{\n \"query\": {\n \"term\": {\n \"geo.src\": \"US\"\n }\n }\n}" - lang: Python source: "resp = client.ml.update_datafeed(\n datafeed_id=\"datafeed-test-job\",\n query={\n \"term\": {\n \"geo.src\": \"US\"\n }\n },\n)" - lang: JavaScript source: "const response = await client.ml.updateDatafeed({\n datafeed_id: \"datafeed-test-job\",\n query: {\n term: {\n \"geo.src\": \"US\",\n },\n },\n});" - lang: Ruby source: "response = client.ml.update_datafeed(\n datafeed_id: \"datafeed-test-job\",\n body: {\n \"query\": {\n \"term\": {\n \"geo.src\": \"US\"\n }\n }\n }\n)" - lang: PHP source: "$resp = $client->ml()->updateDatafeed([\n \"datafeed_id\" => \"datafeed-test-job\",\n \"body\" => [\n \"query\" => [\n \"term\" => [\n \"geo.src\" => \"US\",\n ],\n ],\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"query":{"term":{"geo.src":"US"}}}'' "$ELASTICSEARCH_URL/_ml/datafeeds/datafeed-test-job/_update"' - lang: Java source: "client.ml().updateDatafeed(u -> u\n .datafeedId(\"datafeed-test-job\")\n .query(q -> q\n .term(t -> t\n .field(\"geo.src\")\n .value(FieldValue.of(\"US\"))\n )\n )\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/filters/{filter_id}/_update: post: tags: - ml anomaly summary: Update a filter description: Updates the description of a filter, adds items, or removes items from the list. operationId: ml-update-filter parameters: - in: path name: filter_id description: A string that uniquely identifies a filter. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: add_items: description: The items to add to the filter. type: array items: type: string description: description: A description for the filter. type: string remove_items: description: The items to remove from the filter. type: array items: type: string examples: MlUpdateFilterExample1: description: An example body for a `POST _ml/filters/safe_domains/_update` request. value: "{\n \"description\": \"Updated list of domains\",\n \"add_items\": [\"*.myorg.com\"],\n \"remove_items\": [\"wikipedia.org\"]\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: description: type: string filter_id: allOf: - $ref: '#/components/schemas/_types.Id' items: type: array items: type: string required: - description - filter_id - items x-state: Generally available; Added in 6.4.0 x-variations: - "
\n POST\n /_ml/filters/{filter_id}/_update\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: update_filter.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/filters/safe_domains/_update\n{\n \"description\": \"Updated list of domains\",\n \"add_items\": [\"*.myorg.com\"],\n \"remove_items\": [\"wikipedia.org\"]\n}" - lang: Python source: "resp = client.ml.update_filter(\n filter_id=\"safe_domains\",\n description=\"Updated list of domains\",\n add_items=[\n \"*.myorg.com\"\n ],\n remove_items=[\n \"wikipedia.org\"\n ],\n)" - lang: JavaScript source: "const response = await client.ml.updateFilter({\n filter_id: \"safe_domains\",\n description: \"Updated list of domains\",\n add_items: [\"*.myorg.com\"],\n remove_items: [\"wikipedia.org\"],\n});" - lang: Ruby source: "response = client.ml.update_filter(\n filter_id: \"safe_domains\",\n body: {\n \"description\": \"Updated list of domains\",\n \"add_items\": [\n \"*.myorg.com\"\n ],\n \"remove_items\": [\n \"wikipedia.org\"\n ]\n }\n)" - lang: PHP source: "$resp = $client->ml()->updateFilter([\n \"filter_id\" => \"safe_domains\",\n \"body\" => [\n \"description\" => \"Updated list of domains\",\n \"add_items\" => array(\n \"*.myorg.com\",\n ),\n \"remove_items\" => array(\n \"wikipedia.org\",\n ),\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"Updated list of domains","add_items":["*.myorg.com"],"remove_items":["wikipedia.org"]}'' "$ELASTICSEARCH_URL/_ml/filters/safe_domains/_update"' - lang: Java source: "client.ml().updateFilter(u -> u\n .addItems(\"*.myorg.com\")\n .description(\"Updated list of domains\")\n .filterId(\"safe_domains\")\n .removeItems(\"wikipedia.org\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/_update: post: tags: - ml anomaly summary: Update an anomaly detection job description: Updates certain properties of an anomaly detection job. operationId: ml-update-job parameters: - in: path name: job_id description: Identifier for the job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: allow_lazy_open: description: 'Advanced configuration option. Specifies whether this job can open when there is insufficient machine learning node capacity for it to be immediately assigned to a node. If `false` and a machine learning node with capacity to run the job cannot immediately be found, the open anomaly detection jobs API returns an error. However, this is also subject to the cluster-wide `xpack.ml.max_lazy_ml_nodes` setting. If this option is set to `true`, the open anomaly detection jobs API does not return an error and the job waits in the opening state until sufficient machine learning node capacity is available.' default: false type: boolean analysis_limits: allOf: - $ref: '#/components/schemas/ml._types.AnalysisMemoryLimit' background_persist_interval: description: 'Advanced configuration option. The time between each periodic persistence of the model. The default value is a randomized value between 3 to 4 hours, which avoids all jobs persisting at exactly the same time. The smallest allowed value is 1 hour. For very large models (several GB), persistence could take 10-20 minutes, so do not set the value too low. If the job is open when you make the update, you must stop the datafeed, close the job, then reopen the job and restart the datafeed for the changes to take effect.' allOf: - $ref: '#/components/schemas/_types.Duration' custom_settings: description: 'Advanced configuration option. Contains custom meta data about the job. For example, it can contain custom URL information as shown in Adding custom URLs to machine learning results.' type: object additionalProperties: type: object categorization_filters: type: array items: type: string description: description: A description of the job. type: string model_plot_config: allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_prune_window: allOf: - $ref: '#/components/schemas/_types.Duration' daily_model_snapshot_retention_after_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies a period of time (in days) after which only the first snapshot per day is retained. This period is relative to the timestamp of the most recent snapshot for this job. Valid values range from 0 to `model_snapshot_retention_days`. For jobs created before version 7.8.0, the default value matches `model_snapshot_retention_days`.' default: 1.0 type: number model_snapshot_retention_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies the maximum period of time (in days) that snapshots are retained. This period is relative to the timestamp of the most recent snapshot for this job.' default: 10.0 type: number renormalization_window_days: description: 'Advanced configuration option. The period over which adjustments to the score are applied, as new data is seen.' type: number results_retention_days: description: 'Advanced configuration option. The period of time (in days) that results are retained. Age is calculated relative to the timestamp of the latest bucket result. If this property has a non-null value, once per day at 00:30 (server time), results that are the specified number of days older than the latest bucket result are deleted from Elasticsearch. The default value is null, which means all results are retained.' type: number groups: description: A list of job groups. A job can belong to no groups or many. type: array items: type: string detectors: description: An array of detector update objects. type: array items: $ref: '#/components/schemas/ml._types.DetectorUpdate' per_partition_categorization: description: Settings related to how categorization interacts with partition fields. allOf: - $ref: '#/components/schemas/ml._types.PerPartitionCategorization' examples: MlUpdateJobExample1: description: An example body for a `POST _ml/anomaly_detectors/low_request_rate/_update` request. value: "{\n \"description\":\"An updated job\",\n \"detectors\": {\n \"detector_index\": 0,\n \"description\": \"An updated detector description\"\n },\n \"groups\": [\"kibana_sample_data\",\"kibana_sample_web_logs\"],\n \"model_plot_config\": {\n \"enabled\": true\n },\n \"renormalization_window_days\": 30,\n \"background_persist_interval\": \"2h\",\n \"model_snapshot_retention_days\": 7,\n \"results_retention_days\": 60\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: allow_lazy_open: type: boolean analysis_config: allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfigRead' analysis_limits: allOf: - $ref: '#/components/schemas/ml._types.AnalysisLimits' background_persist_interval: allOf: - $ref: '#/components/schemas/_types.Duration' create_time: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' finished_time: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' custom_settings: type: object additionalProperties: type: string daily_model_snapshot_retention_after_days: type: number data_description: allOf: - $ref: '#/components/schemas/ml._types.DataDescription' datafeed_config: allOf: - $ref: '#/components/schemas/ml._types.Datafeed' description: type: string groups: type: array items: type: string job_id: allOf: - $ref: '#/components/schemas/_types.Id' job_type: type: string job_version: allOf: - $ref: '#/components/schemas/_types.VersionString' model_plot_config: allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_snapshot_id: allOf: - $ref: '#/components/schemas/_types.Id' model_snapshot_retention_days: type: number renormalization_window_days: type: number results_index_name: allOf: - $ref: '#/components/schemas/_types.IndexName' results_retention_days: type: number required: - allow_lazy_open - analysis_config - analysis_limits - create_time - daily_model_snapshot_retention_after_days - data_description - job_id - job_type - job_version - model_snapshot_retention_days - results_index_name x-state: Generally available; Added in 5.5.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/_update\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: update_job.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST _ml/anomaly_detectors/low_request_rate/_update\n{\n \"description\":\"An updated job\",\n \"detectors\": {\n \"detector_index\": 0,\n \"description\": \"An updated detector description\"\n },\n \"groups\": [\"kibana_sample_data\",\"kibana_sample_web_logs\"],\n \"model_plot_config\": {\n \"enabled\": true\n },\n \"renormalization_window_days\": 30,\n \"background_persist_interval\": \"2h\",\n \"model_snapshot_retention_days\": 7,\n \"results_retention_days\": 60\n}" - lang: Python source: "resp = client.ml.update_job(\n job_id=\"low_request_rate\",\n description=\"An updated job\",\n detectors={\n \"detector_index\": 0,\n \"description\": \"An updated detector description\"\n },\n groups=[\n \"kibana_sample_data\",\n \"kibana_sample_web_logs\"\n ],\n model_plot_config={\n \"enabled\": True\n },\n renormalization_window_days=30,\n background_persist_interval=\"2h\",\n model_snapshot_retention_days=7,\n results_retention_days=60,\n)" - lang: JavaScript source: "const response = await client.ml.updateJob({\n job_id: \"low_request_rate\",\n description: \"An updated job\",\n detectors: {\n detector_index: 0,\n description: \"An updated detector description\",\n },\n groups: [\"kibana_sample_data\", \"kibana_sample_web_logs\"],\n model_plot_config: {\n enabled: true,\n },\n renormalization_window_days: 30,\n background_persist_interval: \"2h\",\n model_snapshot_retention_days: 7,\n results_retention_days: 60,\n});" - lang: Ruby source: "response = client.ml.update_job(\n job_id: \"low_request_rate\",\n body: {\n \"description\": \"An updated job\",\n \"detectors\": {\n \"detector_index\": 0,\n \"description\": \"An updated detector description\"\n },\n \"groups\": [\n \"kibana_sample_data\",\n \"kibana_sample_web_logs\"\n ],\n \"model_plot_config\": {\n \"enabled\": true\n },\n \"renormalization_window_days\": 30,\n \"background_persist_interval\": \"2h\",\n \"model_snapshot_retention_days\": 7,\n \"results_retention_days\": 60\n }\n)" - lang: PHP source: "$resp = $client->ml()->updateJob([\n \"job_id\" => \"low_request_rate\",\n \"body\" => [\n \"description\" => \"An updated job\",\n \"detectors\" => [\n \"detector_index\" => 0,\n \"description\" => \"An updated detector description\",\n ],\n \"groups\" => array(\n \"kibana_sample_data\",\n \"kibana_sample_web_logs\",\n ),\n \"model_plot_config\" => [\n \"enabled\" => true,\n ],\n \"renormalization_window_days\" => 30,\n \"background_persist_interval\" => \"2h\",\n \"model_snapshot_retention_days\" => 7,\n \"results_retention_days\" => 60,\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"An updated job","detectors":{"detector_index":0,"description":"An updated detector description"},"groups":["kibana_sample_data","kibana_sample_web_logs"],"model_plot_config":{"enabled":true},"renormalization_window_days":30,"background_persist_interval":"2h","model_snapshot_retention_days":7,"results_retention_days":60}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/_update"' - lang: Java source: "client.ml().updateJob(u -> u\n .backgroundPersistInterval(b -> b\n .time(\"2h\")\n )\n .description(\"An updated job\")\n .detectors(d -> d\n .detectorIndex(0)\n .description(\"An updated detector description\")\n )\n .groups(List.of(\"kibana_sample_data\",\"kibana_sample_web_logs\"))\n .jobId(\"low_request_rate\")\n .modelPlotConfig(m -> m\n .enabled(true)\n )\n .modelSnapshotRetentionDays(7L)\n .renormalizationWindowDays(30L)\n .resultsRetentionDays(60L)\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_update: post: tags: - ml anomaly summary: Update a snapshot description: Updates certain properties of a snapshot. operationId: ml-update-model-snapshot parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: Identifier for the model snapshot. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple requestBody: content: application/json: schema: type: object properties: description: description: A description of the model snapshot. type: string retain: description: 'If `true`, this snapshot will not be deleted during automatic cleanup of snapshots older than `model_snapshot_retention_days`. However, this snapshot will be deleted when the job is deleted.' default: false type: boolean examples: MlUpdateModelSnapshotExample1: description: An example body for a `POST` request. value: "_ml/anomaly_detectors/it_ops_new_logs/model_snapshots/1491852978/_update\n{\n \"description\": \"Snapshot 1\",\n \"retain\": true\n}" required: true responses: '200': description: '' content: application/json: schema: type: object properties: acknowledged: type: boolean model: allOf: - $ref: '#/components/schemas/ml._types.ModelSnapshot' required: - acknowledged - model x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_update\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: update_model_snapshot.ml x-category: ai/ml x-codeSamples: - lang: Console source: "POST\n_ml/anomaly_detectors/it_ops_new_logs/model_snapshots/1491852978/_update\n{\n \"description\": \"Snapshot 1\",\n \"retain\": true\n}" - lang: Python source: "resp = client.ml.update_model_snapshot(\n job_id=\"it_ops_new_logs\",\n snapshot_id=\"1491852978\",\n description=\"Snapshot 1\",\n retain=True,\n)" - lang: JavaScript source: "const response = await client.ml.updateModelSnapshot({\n job_id: \"it_ops_new_logs\",\n snapshot_id: 1491852978,\n description: \"Snapshot 1\",\n retain: true,\n});" - lang: Ruby source: "response = client.ml.update_model_snapshot(\n job_id: \"it_ops_new_logs\",\n snapshot_id: \"1491852978\",\n body: {\n \"description\": \"Snapshot 1\",\n \"retain\": true\n }\n)" - lang: PHP source: "$resp = $client->ml()->updateModelSnapshot([\n \"job_id\" => \"it_ops_new_logs\",\n \"snapshot_id\" => \"1491852978\",\n \"body\" => [\n \"description\" => \"Snapshot 1\",\n \"retain\" => true,\n ],\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"Snapshot 1","retain":true}'' "$ELASTICSEARCH_URL/_ml/anomaly_detectors/it_ops_new_logs/model_snapshots/1491852978/_update"' - lang: Java source: "client.ml().updateModelSnapshot(u -> u\n .description(\"Snapshot 1\")\n .jobId(\"it_ops_new_logs\")\n .retain(true)\n .snapshotId(\"1491852978\")\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_upgrade: post: tags: - ml anomaly summary: Upgrade a snapshot description: 'Upgrade an anomaly detection model snapshot to the latest major version. Over time, older snapshot formats are deprecated and removed. Anomaly detection jobs support only snapshots that are from the current or previous major version. This API provides a means to upgrade a snapshot to the current major version. This aids in preparing the cluster for an upgrade to the next major version. Only one snapshot per anomaly detection job can be upgraded at a time and the upgraded snapshot cannot be the current snapshot of the anomaly detection job.' operationId: ml-upgrade-job-snapshot parameters: - in: path name: job_id description: Identifier for the anomaly detection job. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: path name: snapshot_id description: A numerical character string that uniquely identifies the model snapshot. required: true deprecated: false schema: $ref: '#/components/schemas/_types.Id' style: simple - in: query name: wait_for_completion description: 'When true, the API won’t respond until the upgrade is complete. Otherwise, it responds as soon as the upgrade task is assigned to a node.' deprecated: false schema: type: boolean style: form - in: query name: timeout description: Controls the time to wait for the request to complete. deprecated: false schema: $ref: '#/components/schemas/_types.Duration' style: form responses: '200': description: '' content: application/json: schema: type: object properties: node: description: The ID of the node that the upgrade task was started on if it is still running. In serverless this will be the "serverless". allOf: - $ref: '#/components/schemas/_types.NodeId' completed: description: When true, this means the task is complete. When false, it is still running. type: boolean required: - node - completed x-state: Generally available; Added in 5.4.0 x-variations: - "
\n POST\n /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_upgrade\n
\n " x-req-auth: - 'Cluster privileges: `manage_ml` ' x-api: upgrade_job_snapshot.ml x-category: ai/ml x-codeSamples: - lang: Console source: 'POST _ml/anomaly_detectors/low_request_rate/model_snapshots/1828371/_upgrade?timeout=45m&wait_for_completion=true ' - lang: Python source: "resp = client.ml.upgrade_job_snapshot(\n job_id=\"low_request_rate\",\n snapshot_id=\"1828371\",\n timeout=\"45m\",\n wait_for_completion=True,\n)" - lang: JavaScript source: "const response = await client.ml.upgradeJobSnapshot({\n job_id: \"low_request_rate\",\n snapshot_id: 1828371,\n timeout: \"45m\",\n wait_for_completion: \"true\",\n});" - lang: Ruby source: "response = client.ml.upgrade_job_snapshot(\n job_id: \"low_request_rate\",\n snapshot_id: \"1828371\",\n timeout: \"45m\",\n wait_for_completion: \"true\"\n)" - lang: PHP source: "$resp = $client->ml()->upgradeJobSnapshot([\n \"job_id\" => \"low_request_rate\",\n \"snapshot_id\" => \"1828371\",\n \"timeout\" => \"45m\",\n \"wait_for_completion\" => \"true\",\n]);" - lang: curl source: 'curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/model_snapshots/1828371/_upgrade?timeout=45m&wait_for_completion=true"' - lang: Java source: "client.ml().upgradeJobSnapshot(u -> u\n .jobId(\"low_request_rate\")\n .snapshotId(\"1828371\")\n .timeout(t -> t\n .offset(45)\n )\n .waitForCompletion(true)\n);\n" x-metaTags: - content: Elasticsearch, Machine Learning name: product_name components: schemas: _types.ScriptSort: type: object properties: order: description: "\n\nSupported values include:\n - `asc`: Ascending (smallest to largest)\n - `desc`: Descending (largest to smallest)\n\n" allOf: - $ref: '#/components/schemas/_types.SortOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' type: allOf: - $ref: '#/components/schemas/_types.ScriptSortType' mode: allOf: - $ref: '#/components/schemas/_types.SortMode' nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' required: - script _types.aggregations.GeoLineAggregation: type: object properties: point: description: The name of the geo_point field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLinePoint' sort: description: 'The name of the numeric field to use as the sort key for ordering the points. When the `geo_line` aggregation is nested inside a `time_series` aggregation, this field defaults to `@timestamp`, and any other value will result in error.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineSort' include_sort: description: When `true`, returns an additional array of the sort values in the feature properties. type: boolean sort_order: description: "The order in which the line is sorted (ascending or descending).\n\nSupported values include:\n - `asc`: Ascending (smallest to largest)\n - `desc`: Descending (largest to smallest)\n\n" default: asc allOf: - $ref: '#/components/schemas/_types.SortOrder' size: description: 'The maximum length of the line represented in the aggregation. Valid sizes are between 1 and 10000.' default: 10000.0 type: number required: - point _types.query_dsl.GeoExecution: type: string enum: - memory - indexed ml._types.ChunkingConfig: type: object properties: mode: description: 'If the mode is `auto`, the chunk size is dynamically calculated; this is the recommended value when the datafeed does not use aggregations. If the mode is `manual`, chunking is applied according to the specified `time_span`; use this mode when the datafeed uses aggregations. If the mode is `off`, no chunking is applied.' allOf: - $ref: '#/components/schemas/ml._types.ChunkingMode' time_span: description: The time span that each search will be querying. This setting is applicable only when the `mode` is set to `manual`. default: 3h allOf: - $ref: '#/components/schemas/_types.Duration' required: - mode _types.query_dsl.TermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: description: Term you wish to find in the provided field. allOf: - $ref: '#/components/schemas/_types.FieldValue' case_insensitive: description: 'Allows ASCII case insensitive matching of the value with the indexed field values when set to `true`. When `false`, the case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean required: - value _types.aggregations.RandomSamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: probability: description: 'The probability that a document will be included in the aggregated data. Must be greater than 0, less than 0.5, or exactly 1. The lower the probability, the fewer documents are matched.' type: number seed: description: 'The seed to generate the random sampling of documents. When a seed is provided, the random subset of documents is the same between calls.' type: number shard_seed: description: When combined with seed, setting shard_seed ensures 100% consistent sampling over shards where data is exactly the same. x-state: Generally available; Added in 8.14.0 type: number required: - probability _types.LinearRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retrievers: description: Inner retrievers. type: array items: $ref: '#/components/schemas/_types.InnerRetriever' rank_window_size: type: number query: type: string fields: type: array items: type: string normalizer: allOf: - $ref: '#/components/schemas/_types.ScoreNormalizer' _types.analysis.PhoneticNameType: type: string enum: - generic - ashkenazi - sephardic _types.GeoTilePrecision: type: number ml._types.AnalysisMemoryLimit: type: object properties: model_memory_limit: description: Limits can be applied for the resources required to hold the mathematical models in memory. These limits are approximate and can be set per job. They do not control the memory used by other processes, for example the Elasticsearch Java processes. type: string required: - model_memory_limit ml.get_calendars.Calendar: type: object properties: calendar_id: description: A string that uniquely identifies a calendar. allOf: - $ref: '#/components/schemas/_types.Id' description: description: A description of the calendar. type: string job_ids: description: An array of anomaly detection job identifiers. type: array items: $ref: '#/components/schemas/_types.Id' required: - calendar_id - job_ids _types.analysis.IcuTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - icu_tokenizer rule_files: type: string required: - type - rule_files _types.analysis.DutchStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - dutch_stem required: - type _types.aggregations.DiversifiedSamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: execution_hint: description: "The type of value used for de-duplication.\n\nSupported values include:\n - `map`: Hold field values directly.\n - `global_ordinals`: Hold ordinals of the field as determined by the Lucene index.\n - `bytes_hash`: Hold hashes of the field values - with potential for hash collisions.\n\n" default: global_ordinals allOf: - $ref: '#/components/schemas/_types.aggregations.SamplerAggregationExecutionHint' max_docs_per_value: description: Limits how many documents are permitted per choice of de-duplicating value. default: 1.0 type: number script: allOf: - $ref: '#/components/schemas/_types.Script' shard_size: description: Limits how many top-scoring documents are collected in the sample processed on each shard. default: 100.0 type: number field: description: The field used to provide values used for de-duplication. allOf: - $ref: '#/components/schemas/_types.Field' _types.Metadata: type: object additionalProperties: type: object _types.aggregations.TimeSeriesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: size: description: The maximum number of results to return. default: 10000.0 type: number keyed: description: Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array. type: boolean _types.analysis.CjkBigramIgnoredScript: type: string enum: - han - hangul - hiragana - katakana _types.query_dsl.MatchQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean cutoff_frequency: deprecated: true type: number fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text query value for a numeric field, are ignored. default: false type: boolean max_expansions: description: Maximum number of terms to which the query will expand. default: 50.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: Boolean logic used to interpret text in the query value. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number query: description: Text, number, boolean value or date you wish to find in the provided field. oneOf: - type: string - type: number - type: boolean zero_terms_query: description: "Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter.\n\nSupported values include:\n - `all`: Returns all documents, similar to a `match_all` query.\n - `none`: No documents are returned if the `analyzer` removes all tokens.\n\n" default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.aggregations.FormattableMetricAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: format: type: string _types.analysis.CharFilterDefinition: discriminator: propertyName: type mapping: html_strip: '#/components/schemas/_types.analysis.HtmlStripCharFilter' icu_normalizer: '#/components/schemas/_types.analysis.IcuNormalizationCharFilter' kuromoji_iteration_mark: '#/components/schemas/_types.analysis.KuromojiIterationMarkCharFilter' mapping: '#/components/schemas/_types.analysis.MappingCharFilter' pattern_replace: '#/components/schemas/_types.analysis.PatternReplaceCharFilter' oneOf: - $ref: '#/components/schemas/_types.analysis.HtmlStripCharFilter' - $ref: '#/components/schemas/_types.analysis.MappingCharFilter' - $ref: '#/components/schemas/_types.analysis.PatternReplaceCharFilter' - $ref: '#/components/schemas/_types.analysis.IcuNormalizationCharFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiIterationMarkCharFilter' _types.analysis.ApostropheTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - apostrophe required: - type _types.aggregations.LinearMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - linear settings: allOf: - $ref: '#/components/schemas/_types.EmptyObject' required: - model - settings _types.aggregations.CompositeHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: interval: type: number required: - interval _types.query_dsl.IntervalsFuzzy: type: object properties: analyzer: description: Analyzer used to normalize the term. type: string fuzziness: description: Maximum edit distance allowed for matching. default: auto allOf: - $ref: '#/components/schemas/_types.Fuzziness' prefix_length: description: Number of beginning characters left unchanged when creating expansions. default: 0.0 type: number term: description: The term to match. type: string transpositions: description: Indicates whether edits include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `term` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - term _types.analysis.CharFilter: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/character-filter-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.CharFilterDefinition' _types.aggregations.InferenceConfigContainer: type: object properties: regression: description: Regression configuration for inference. allOf: - $ref: '#/components/schemas/ml._types.RegressionInferenceOptions' classification: description: Classification configuration for inference. allOf: - $ref: '#/components/schemas/ml._types.ClassificationInferenceOptions' minProperties: 1 maxProperties: 1 _types.analysis.MappingCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - mapping mappings: type: array items: type: string mappings_path: type: string required: - type _types.analysis.TruncateTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - truncate length: description: Character limit for each token. Tokens exceeding this limit are truncated. Defaults to `10`. type: number required: - type _types.SlicedScroll: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' id: allOf: - $ref: '#/components/schemas/_types.Id' max: type: number required: - id - max _types.mapping.RuntimeFieldType: type: string enum: - boolean - composite - date - double - geo_point - geo_shape - ip - keyword - long - lookup _types.ExpandWildcard: type: string enum: - all - open - closed - hidden - none ml._types.ExcludeFrequent: type: string enum: - all - none - by - over ml._types.Influencer: type: object properties: bucket_span: description: The length of the bucket in seconds. This value matches the bucket span that is specified in the job. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitSeconds' influencer_score: description: 'A normalized score between 0-100, which is based on the probability of the influencer in this bucket aggregated across detectors. Unlike `initial_influencer_score`, this value is updated by a re-normalization process as new data is analyzed.' type: number influencer_field_name: description: The field name of the influencer. allOf: - $ref: '#/components/schemas/_types.Field' influencer_field_value: description: The entity that influenced, contributed to, or was to blame for the anomaly. type: string initial_influencer_score: description: 'A normalized score between 0-100, which is based on the probability of the influencer aggregated across detectors. This is the initial value that was calculated at the time the bucket was processed.' type: number is_interim: description: If true, this is an interim result. In other words, the results are calculated based on partial input data. type: boolean job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' probability: description: 'The probability that the influencer has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the `influencer_score` is provided as a human-readable and friendly interpretation of this value.' type: number result_type: description: Internal. This value is always set to `influencer`. type: string timestamp: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' foo: description: 'Additional influencer properties are added, depending on the fields being analyzed. For example, if it’s analyzing `user_name` as an influencer, a field `user_name` is added to the result document. This information enables you to filter the anomaly results more easily.' type: string required: - bucket_span - influencer_score - influencer_field_name - influencer_field_value - initial_influencer_score - is_interim - job_id - probability - result_type - timestamp _types.query_dsl.GeoPolygonQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: validation_method: description: "\n\nSupported values include:\n - `coerce`: Accept geo points with invalid latitude or longitude and additionally try and infer correct coordinates.\n - `ignore_malformed`: Accept geo points with invalid latitude or longitude.\n - `strict`\n\n" default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: type: boolean ml._types.AnalysisConfig: type: object properties: bucket_span: description: 'The size of the interval that the analysis is aggregated into, typically between `5m` and `1h`. This value should be either a whole number of days or equate to a whole number of buckets in one day. If the anomaly detection job uses a datafeed with aggregations, this value must also be divisible by the interval of the date histogram aggregation.' default: 5m allOf: - $ref: '#/components/schemas/_types.Duration' categorization_analyzer: description: If `categorization_field_name` is specified, you can also define the analyzer that is used to interpret the categorization field. This property cannot be used at the same time as `categorization_filters`. The categorization analyzer specifies how the `categorization_field` is interpreted by the categorization process. The `categorization_analyzer` field can be specified either as a string or as an object. If it is a string, it must refer to a built-in analyzer or one added by another plugin. allOf: - $ref: '#/components/schemas/ml._types.CategorizationAnalyzer' categorization_field_name: description: If this property is specified, the values of the specified field will be categorized. The resulting categories must be used in a detector by setting `by_field_name`, `over_field_name`, or `partition_field_name` to the keyword `mlcategory`. allOf: - $ref: '#/components/schemas/_types.Field' categorization_filters: description: If `categorization_field_name` is specified, you can also define optional filters. This property expects an array of regular expressions. The expressions are used to filter out matching sequences from the categorization field values. You can use this functionality to fine tune the categorization by excluding sequences from consideration when categories are defined. For example, you can exclude SQL statements that appear in your log files. This property cannot be used at the same time as `categorization_analyzer`. If you only want to define simple regular expression filters that are applied prior to tokenization, setting this property is the easiest method. If you also want to customize the tokenizer or post-tokenization filtering, use the `categorization_analyzer` property instead and include the filters as pattern_replace character filters. The effect is exactly the same. type: array items: type: string detectors: description: Detector configuration objects specify which data fields a job analyzes. They also specify which analytical functions are used. You can specify multiple detectors for a job. If the detectors array does not contain at least one detector, no analysis can occur and an error is returned. type: array items: $ref: '#/components/schemas/ml._types.Detector' influencers: description: A comma separated list of influencer field names. Typically these can be the by, over, or partition fields that are used in the detector configuration. You might also want to use a field name that is not specifically named in a detector, but is available as part of the input data. When you use multiple detectors, the use of influencers is recommended as it aggregates results for each influencer entity. type: array items: $ref: '#/components/schemas/_types.Field' latency: description: 'The size of the window in which to expect data that is out of time order. If you specify a non-zero value, it must be greater than or equal to one second. NOTE: Latency is applicable only when you send data by using the post data API.' default: '0' allOf: - $ref: '#/components/schemas/_types.Duration' model_prune_window: description: Advanced configuration option. Affects the pruning of models that have not been updated for the given time duration. The value must be set to a multiple of the `bucket_span`. If set too low, important information may be removed from the model. For jobs created in 8.1 and later, the default value is the greater of `30d` or 20 times `bucket_span`. allOf: - $ref: '#/components/schemas/_types.Duration' multivariate_by_fields: description: This functionality is reserved for internal use. It is not supported for use in customer environments and is not subject to the support SLA of official GA features. If set to `true`, the analysis will automatically find correlations between metrics for a given by field value and report anomalies when those correlations cease to hold. For example, suppose CPU and memory usage on host A is usually highly correlated with the same metrics on host B. Perhaps this correlation occurs because they are running a load-balanced application. If you enable this property, anomalies will be reported when, for example, CPU usage on host A is high and the value of CPU usage on host B is low. That is to say, you’ll see an anomaly when the CPU of host A is unusual given the CPU of host B. To use the `multivariate_by_fields` property, you must also specify `by_field_name` in your detector. type: boolean per_partition_categorization: description: Settings related to how categorization interacts with partition fields. allOf: - $ref: '#/components/schemas/ml._types.PerPartitionCategorization' summary_count_field_name: description: 'If this property is specified, the data that is fed to the job is expected to be pre-summarized. This property value is the name of the field that contains the count of raw data points that have been summarized. The same `summary_count_field_name` applies to all detectors in the job. NOTE: The `summary_count_field_name` property cannot be used with the `metric` function.' allOf: - $ref: '#/components/schemas/_types.Field' required: - detectors _types.aggregations.IpRangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are used to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' ranges: description: Array of IP ranges. type: array items: $ref: '#/components/schemas/_types.aggregations.IpRangeAggregationRange' _types.query_dsl.RangeQueryBasedouble: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: "Indicates how the range query matches values for `range` fields.\n\nSupported values include:\n - `within`: Matches documents with a range field value entirely within the query’s range.\n - `contains`: Matches documents with a range field value that entirely contains the query’s range.\n - `intersects`: Matches documents with a range field value that intersects the query’s range.\n\n" default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: number gte: description: Greater than or equal to. type: number lt: description: Less than. type: number lte: description: Less than or equal to. type: number _types.IndicesOptions: description: 'Controls how to deal with unavailable concrete indices (closed or missing), how wildcard expressions are expanded to actual indices (all, closed or open indices) and how to deal with wildcard expressions that resolve to no indices.' type: object properties: allow_no_indices: description: 'If false, the request returns an error if any wildcard expression, index alias, or `_all` value targets only missing or closed indices. This behavior applies even if the request targets other open indices. For example, a request targeting `foo*,bar*` returns an error if an index starts with `foo` but no index starts with `bar`.' type: boolean expand_wildcards: description: "Type of index that wildcard patterns can match. If the request can target data streams, this argument\ndetermines whether wildcard expressions match hidden data streams. Supports comma-separated values,\nsuch as `open,hidden`.\n\nSupported values include:\n - `all`: Match any data stream or index, including hidden ones.\n - `open`: Match open, non-hidden indices. Also matches any non-hidden data stream.\n - `closed`: Match closed, non-hidden indices. Also matches any non-hidden data stream. Data streams cannot be closed.\n - `hidden`: Match hidden data streams and hidden indices. Must be combined with `open`, `closed`, or `both`.\n - `none`: Wildcard expressions are not accepted.\n\n" allOf: - $ref: '#/components/schemas/_types.ExpandWildcards' ignore_unavailable: description: If true, missing or closed indices are not included in the response. default: false type: boolean ignore_throttled: description: If true, concrete, expanded or aliased indices are ignored when frozen. default: true type: boolean ml._types.GeoResults: type: object properties: actual_point: description: The actual value for the bucket formatted as a `geo_point`. type: string typical_point: description: The typical value for the bucket formatted as a `geo_point`. type: string _types.aggregations.BucketScriptAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script to run for this aggregation. allOf: - $ref: '#/components/schemas/_types.Script' _types.query_dsl.TermsSetQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: minimum_should_match: description: Specification describing number of matching terms required to return a document. x-state: Generally available; Added in 8.10.0 allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' minimum_should_match_field: description: Numeric field containing the number of matching terms required to return a document. allOf: - $ref: '#/components/schemas/_types.Field' minimum_should_match_script: description: Custom script containing the number of matching terms required to return a document. allOf: - $ref: '#/components/schemas/_types.Script' terms: description: Array of terms you wish to find in the provided field. type: array items: $ref: '#/components/schemas/_types.FieldValue' required: - terms ml._types.DatafeedState: type: string enum: - started - stopped - starting - stopping _types.aggregations.TTestType: type: string enum: - paired - homoscedastic - heteroscedastic _types.DurationValueUnitMillis: allOf: - $ref: '#/components/schemas/_types.UnitMillis' _types.query_dsl.GeoShapeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean ml._types.Anomaly: type: object properties: actual: description: The actual value for the bucket. type: array items: type: number anomaly_score_explanation: description: Information about the factors impacting the initial anomaly score. allOf: - $ref: '#/components/schemas/ml._types.AnomalyExplanation' bucket_span: description: The length of the bucket in seconds. This value matches the `bucket_span` that is specified in the job. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitSeconds' by_field_name: description: The field used to split the data. In particular, this property is used for analyzing the splits with respect to their own history. It is used for finding unusual values in the context of the split. type: string by_field_value: description: The value of `by_field_name`. type: string causes: description: For population analysis, an over field must be specified in the detector. This property contains an array of anomaly records that are the causes for the anomaly that has been identified for the over field. This sub-resource contains the most anomalous records for the `over_field_name`. For scalability reasons, a maximum of the 10 most significant causes of the anomaly are returned. As part of the core analytical modeling, these low-level anomaly records are aggregated for their parent over field record. The `causes` resource contains similar elements to the record resource, namely `actual`, `typical`, `geo_results.actual_point`, `geo_results.typical_point`, `*_field_name` and `*_field_value`. Probability and scores are not applicable to causes. type: array items: $ref: '#/components/schemas/ml._types.AnomalyCause' detector_index: description: A unique identifier for the detector. type: number field_name: description: Certain functions require a field to operate on, for example, `sum()`. For those functions, this value is the name of the field to be analyzed. type: string function: description: The function in which the anomaly occurs, as specified in the detector configuration. For example, `max`. type: string function_description: description: The description of the function in which the anomaly occurs, as specified in the detector configuration. type: string geo_results: description: If the detector function is `lat_long`, this object contains comma delimited strings for the latitude and longitude of the actual and typical values. allOf: - $ref: '#/components/schemas/ml._types.GeoResults' influencers: description: If influencers were specified in the detector configuration, this array contains influencers that contributed to or were to blame for an anomaly. type: array items: $ref: '#/components/schemas/ml._types.Influence' initial_record_score: description: A normalized score between 0-100, which is based on the probability of the anomalousness of this record. This is the initial value that was calculated at the time the bucket was processed. type: number is_interim: description: If true, this is an interim result. In other words, the results are calculated based on partial input data. type: boolean job_id: description: Identifier for the anomaly detection job. type: string over_field_name: description: The field used to split the data. In particular, this property is used for analyzing the splits with respect to the history of all splits. It is used for finding unusual values in the population of all splits. type: string over_field_value: description: The value of `over_field_name`. type: string partition_field_name: description: The field used to segment the analysis. When you use this property, you have completely independent baselines for each value of this field. type: string partition_field_value: description: The value of `partition_field_name`. type: string probability: description: The probability of the individual anomaly occurring, in the range 0 to 1. For example, `0.0000772031`. This value can be held to a high precision of over 300 decimal places, so the `record_score` is provided as a human-readable and friendly interpretation of this. type: number record_score: description: A normalized score between 0-100, which is based on the probability of the anomalousness of this record. Unlike `initial_record_score`, this value will be updated by a re-normalization process as new data is analyzed. type: number result_type: description: Internal. This is always set to `record`. type: string timestamp: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' typical: description: The typical value for the bucket, according to analytical modeling. type: array items: type: number required: - bucket_span - detector_index - initial_record_score - is_interim - job_id - probability - record_score - result_type - timestamp _types.aggregations.MatrixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: fields: description: An array of fields for computing the statistics. allOf: - $ref: '#/components/schemas/_types.Fields' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: object additionalProperties: type: number _types.analysis.IcuFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_folding unicode_set_filter: type: string required: - type - unicode_set_filter _types.query_dsl.Like: description: Text that we want similar documents for or a lookup to a document's field for the text. oneOf: - type: string - $ref: '#/components/schemas/_types.query_dsl.LikeDocument' _types.query_dsl.MultiMatchQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean cutoff_frequency: deprecated: true type: number fields: description: 'The fields to be queried. Defaults to the `index.query.default_field` index settings, which in turn defaults to `*`.' allOf: - $ref: '#/components/schemas/_types.Fields' fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: 'If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). Can be applied to the term subqueries constructed for all terms but the final term.' default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text query value for a numeric field, are ignored. default: false type: boolean max_expansions: description: Maximum number of terms to which the query will expand. default: 50.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: Boolean logic used to interpret text in the query value. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number query: description: Text, number, boolean value or date you wish to find in the provided field. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number tie_breaker: description: Determines how scores for each per-term blended query and scores across groups are combined. default: 0.0 type: number type: description: "How `the` multi_match query is executed internally.\n\nSupported values include:\n - `best_fields`: Finds documents that match any field, but uses the `_score` from the best field.\n - `most_fields`: Finds documents that match any field and combines the `_score` from each field.\n - `cross_fields`: Treats fields with the same analyzer as though they were one big field.\nLooks for each word in any field.\n - `phrase`: Runs a `match_phrase` query on each field and uses the `_score` from the best field.\n - `phrase_prefix`: Runs a `match_phrase_prefix` query on each field and uses the `_score` from the best field.\n - `bool_prefix`: Creates a `match_bool_prefix` query on each field and combines the `_score` from each field.\n\n" default: '''best_fields''' allOf: - $ref: '#/components/schemas/_types.query_dsl.TextQueryType' zero_terms_query: description: "Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter.\n\nSupported values include:\n - `all`: Returns all documents, similar to a `match_all` query.\n - `none`: No documents are returned if the `analyzer` removes all tokens.\n\n" default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.Field: description: Path to field or array of paths. Some API's support wildcards in the path to select multiple fields. type: string _types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator: type: object properties: doc_count: description: 'The total number of documents that initially created the expectations. It’s required to be greater than or equal to the sum of all values in the buckets_path as this is the originating superset of data to which the term values are correlated.' type: number expectations: description: 'An array of numbers with which to correlate the configured `bucket_path` values. The length of this value must always equal the number of buckets returned by the `bucket_path`.' type: array items: type: number fractions: description: 'An array of fractions to use when averaging and calculating variance. This should be used if the pre-calculated data and the buckets_path have known gaps. The length of fractions, if provided, must equal expectations.' type: array items: type: number required: - doc_count - expectations _types.aggregations.SumAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.QueryVector: type: array items: type: number _types.query_dsl.RuleQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: organic: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' ruleset_ids: oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' ruleset_id: type: string match_criteria: type: object required: - organic - match_criteria _types.Duration: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/api-conventions#time-units description: 'A duration. Units can be `nanos`, `micros`, `ms` (milliseconds), `s` (seconds), `m` (minutes), `h` (hours) and `d` (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.' oneOf: - type: string - type: string enum: - '-1' - type: string enum: - '0' _types.GeoLocation: description: 'A latitude/longitude as a 2 dimensional point. It can be represented in various ways: - as a `{lat, long}` object - as a geo hash value - as a `[lon, lat]` array - as a string in `", "` or WKT point formats' oneOf: - $ref: '#/components/schemas/_types.LatLonGeoLocation' - $ref: '#/components/schemas/_types.GeoHashLocation' - type: array items: type: number - type: string _types.query_dsl.MatchPhrasePrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert text in the query value into tokens. type: string max_expansions: description: Maximum number of terms to which the last provided term of the query value will expand. default: 50.0 type: number query: description: Text you wish to find in the provided field. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number zero_terms_query: description: "Indicates whether no documents are returned if the analyzer removes all tokens, such as when using a `stop` filter.\n\nSupported values include:\n - `all`: Returns all documents, similar to a `match_all` query.\n - `none`: No documents are returned if the `analyzer` removes all tokens.\n\n" default: none allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.aggregations.ScriptedMetricAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: combine_script: description: 'Runs once on each shard after document collection is complete. Allows the aggregation to consolidate the state returned from each shard.' allOf: - $ref: '#/components/schemas/_types.Script' init_script: description: 'Runs prior to any collection of documents. Allows the aggregation to set up any initial state.' allOf: - $ref: '#/components/schemas/_types.Script' map_script: description: 'Run once per document collected. If no `combine_script` is specified, the resulting state needs to be stored in the `state` object.' allOf: - $ref: '#/components/schemas/_types.Script' params: description: 'A global object with script parameters for `init`, `map` and `combine` scripts. It is shared between the scripts.' type: object additionalProperties: type: object reduce_script: description: 'Runs once on the coordinating node after all shards have returned their results. The script is provided with access to a variable `states`, which is an array of the result of the `combine_script` on each shard.' allOf: - $ref: '#/components/schemas/_types.Script' _types.aggregations.DateRangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are use to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' format: description: The date format used to format `from` and `to` in the response. type: string missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' ranges: description: Array of date ranges. type: array items: $ref: '#/components/schemas/_types.aggregations.DateRangeExpression' time_zone: description: Time zone used to convert dates from another time zone to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' keyed: description: Set to `true` to associate a unique string key with each bucket and returns the ranges as a hash rather than an array. type: boolean ml._types.Job: type: object properties: allow_lazy_open: description: 'Advanced configuration option. Specifies whether this job can open when there is insufficient machine learning node capacity for it to be immediately assigned to a node.' type: boolean analysis_config: description: 'The analysis configuration, which specifies how to analyze the data. After you create a job, you cannot change the analysis configuration; all the properties are informational.' allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfig' analysis_limits: description: 'Limits can be applied for the resources required to hold the mathematical models in memory. These limits are approximate and can be set per job. They do not control the memory used by other processes, for example the Elasticsearch Java processes.' allOf: - $ref: '#/components/schemas/ml._types.AnalysisLimits' background_persist_interval: description: 'Advanced configuration option. The time between each periodic persistence of the model. The default value is a randomized value between 3 to 4 hours, which avoids all jobs persisting at exactly the same time. The smallest allowed value is 1 hour.' allOf: - $ref: '#/components/schemas/_types.Duration' blocked: allOf: - $ref: '#/components/schemas/ml._types.JobBlocked' create_time: allOf: - $ref: '#/components/schemas/_types.DateTime' custom_settings: description: 'Advanced configuration option. Contains custom metadata about the job.' allOf: - $ref: '#/components/schemas/ml._types.CustomSettings' daily_model_snapshot_retention_after_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies a period of time (in days) after which only the first snapshot per day is retained. This period is relative to the timestamp of the most recent snapshot for this job. Valid values range from 0 to `model_snapshot_retention_days`.' default: 1.0 type: number data_description: description: 'The data description defines the format of the input data when you send data to the job by using the post data API. Note that when configuring a datafeed, these properties are automatically set. When data is received via the post data API, it is not stored in Elasticsearch. Only the results for anomaly detection are retained.' allOf: - $ref: '#/components/schemas/ml._types.DataDescription' datafeed_config: description: 'The datafeed, which retrieves data from Elasticsearch for analysis by the job. You can associate only one datafeed with each anomaly detection job.' allOf: - $ref: '#/components/schemas/ml._types.Datafeed' deleting: description: 'Indicates that the process of deleting the job is in progress but not yet completed. It is only reported when `true`.' type: boolean description: description: A description of the job. type: string finished_time: description: 'If the job closed or failed, this is the time the job finished, otherwise it is `null`. This property is informational; you cannot change its value.' allOf: - $ref: '#/components/schemas/_types.DateTime' groups: description: 'A list of job groups. A job can belong to no groups or many.' type: array items: type: string job_id: description: 'Identifier for the anomaly detection job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' allOf: - $ref: '#/components/schemas/_types.Id' job_type: description: Reserved for future use, currently set to `anomaly_detector`. type: string job_version: description: The machine learning configuration version number at which the the job was created. allOf: - $ref: '#/components/schemas/_types.VersionString' model_plot_config: description: 'This advanced configuration option stores model information along with the results. It provides a more detailed view into anomaly detection. Model plot provides a simplified and indicative view of the model and its bounds.' allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_snapshot_id: allOf: - $ref: '#/components/schemas/_types.Id' model_snapshot_retention_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies the maximum period of time (in days) that snapshots are retained. This period is relative to the timestamp of the most recent snapshot for this job. By default, snapshots ten days older than the newest snapshot are deleted.' type: number renormalization_window_days: description: 'Advanced configuration option. The period over which adjustments to the score are applied, as new data is seen. The default value is the longer of 30 days or 100 `bucket_spans`.' type: number results_index_name: description: 'A text string that affects the name of the machine learning results index. The default value is `shared`, which generates an index named `.ml-anomalies-shared`.' allOf: - $ref: '#/components/schemas/_types.IndexName' results_retention_days: description: 'Advanced configuration option. The period of time (in days) that results are retained. Age is calculated relative to the timestamp of the latest bucket result. If this property has a non-null value, once per day at 00:30 (server time), results that are the specified number of days older than the latest bucket result are deleted from Elasticsearch. The default value is null, which means all results are retained. Annotations generated by the system also count as results for retention purposes; they are deleted after the same number of days as results. Annotations added by users are retained forever.' type: number required: - allow_lazy_open - analysis_config - data_description - job_id - model_snapshot_retention_days - results_index_name _types.SortCombinations: oneOf: - $ref: '#/components/schemas/_types.Field' - $ref: '#/components/schemas/_types.SortOptions' _types.query_dsl.DateDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBaseDateMathDuration' - type: object _types.query_dsl.ExistsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: Name of the field you wish to search. allOf: - $ref: '#/components/schemas/_types.Field' required: - field ml._types.JobForecastStatistics: type: object properties: memory_bytes: allOf: - $ref: '#/components/schemas/ml._types.JobStatistics' processing_time_ms: allOf: - $ref: '#/components/schemas/ml._types.JobStatistics' records: allOf: - $ref: '#/components/schemas/ml._types.JobStatistics' status: type: object additionalProperties: type: number total: type: number forecasted_jobs: type: number required: - total - forecasted_jobs _types.aggregations.PipelineAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: format: description: '`DecimalFormat` pattern for the output value. If specified, the formatted value is returned in the aggregation’s `value_as_string` property.' type: string gap_policy: description: "Policy to apply when gaps are found in the data.\n\nSupported values include:\n - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and\ncontinue calculating using the next available value.\n - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.\n - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,\notherwise the empty bucket is skipped.\n\n" default: skip allOf: - $ref: '#/components/schemas/_types.aggregations.GapPolicy' _types.aggregations.WeightedAverageValue: type: object properties: field: description: The field from which to extract the values or weights. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: A value or weight to use if the field is missing. type: number script: allOf: - $ref: '#/components/schemas/_types.Script' _types.analysis.SynonymGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilterBase' - type: object properties: type: type: string enum: - synonym_graph required: - type _types.GeoHashLocation: type: object properties: geohash: allOf: - $ref: '#/components/schemas/_types.GeoHash' required: - geohash _types.aggregations.FormatMetricAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: format: type: string _types.analysis.IcuCollationAlternate: type: string enum: - shifted - non-ignorable _types.aggregations.BucketsPath: description: 'Buckets path can be expressed in different ways, and an aggregation may accept some or all of these forms depending on its type. Please refer to each aggregation''s documentation to know what buckets path forms they accept.' oneOf: - type: string - type: array items: type: string - type: object additionalProperties: type: string _global.search._types.HighlightField: allOf: - $ref: '#/components/schemas/_global.search._types.HighlightBase' - type: object properties: fragment_offset: type: number matched_fields: allOf: - $ref: '#/components/schemas/_types.Fields' _types.query_dsl.ScriptScoreFunction: type: object properties: script: description: A script that computes a score. allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.aggregations.MatrixStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MatrixAggregation' - type: object properties: mode: description: Array value the aggregation will use for array or multi-valued fields. default: avg allOf: - $ref: '#/components/schemas/_types.SortMode' _types.TopLeftBottomRightGeoBounds: type: object properties: top_left: allOf: - $ref: '#/components/schemas/_types.GeoLocation' bottom_right: allOf: - $ref: '#/components/schemas/_types.GeoLocation' required: - top_left - bottom_right _types.query_dsl.QueryBase: type: object properties: boost: description: 'Floating point number used to decrease or increase the relevance scores of the query. Boost values are relative to the default value of 1.0. A boost value between 0 and 1.0 decreases the relevance score. A value greater than 1.0 increases the relevance score.' default: 1.0 type: number _name: type: string _types.TokenPruningConfig: type: object properties: tokens_freq_ratio_threshold: description: Tokens whose frequency is more than this threshold times the average frequency of all tokens in the specified field are considered outliers and pruned. default: 5.0 type: number tokens_weight_threshold: description: Tokens whose weight is less than this threshold are considered nonsignificant and pruned. default: 0.4 type: number only_score_pruned_tokens: description: Whether to only score pruned tokens, vs only scoring kept tokens. default: false type: boolean _global.search._types.Highlight: allOf: - $ref: '#/components/schemas/_global.search._types.HighlightBase' - type: object properties: encoder: allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterEncoder' fields: oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_global.search._types.HighlightField' minProperties: 1 maxProperties: 1 - type: array items: type: object additionalProperties: $ref: '#/components/schemas/_global.search._types.HighlightField' minProperties: 1 maxProperties: 1 required: - fields _types.query_dsl.SpanMultiTermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: match: description: Should be a multi term query (one of `wildcard`, `fuzzy`, `prefix`, `range`, or `regexp` query). allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - match _types.analysis.PhoneticEncoder: type: string enum: - metaphone - double_metaphone - soundex - refined_soundex - caverphone1 - caverphone2 - cologne - nysiis - koelnerphonetik - haasephonetik - beider_morse - daitch_mokotoff ml._types.DatafeedRunningState: type: object properties: real_time_configured: description: Indicates if the datafeed is "real-time"; meaning that the datafeed has no configured `end` time. type: boolean real_time_running: description: 'Indicates whether the datafeed has finished running on the available past data. For datafeeds without a configured `end` time, this means that the datafeed is now running on "real-time" data.' type: boolean search_interval: description: Provides the latest time interval the datafeed has searched. allOf: - $ref: '#/components/schemas/ml._types.RunningStateSearchInterval' required: - real_time_configured - real_time_running _types.mapping.RuntimeField: type: object properties: fields: description: For type `composite` type: object additionalProperties: $ref: '#/components/schemas/_types.mapping.CompositeSubField' fetch_fields: description: For type `lookup` type: array items: $ref: '#/components/schemas/_types.mapping.RuntimeFieldFetchFields' format: description: A custom format for `date` type runtime fields. type: string input_field: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.Field' target_field: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.Field' target_index: description: For type `lookup` allOf: - $ref: '#/components/schemas/_types.IndexName' script: description: Painless script executed at query time. allOf: - $ref: '#/components/schemas/_types.Script' type: description: 'Field type, which can be: `boolean`, `composite`, `date`, `double`, `geo_point`, `ip`,`keyword`, `long`, or `lookup`.' allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFieldType' required: - type ml._types.AnalysisLimits: type: object properties: categorization_examples_limit: description: 'The maximum number of examples stored per category in memory and in the results data store. If you increase this value, more examples are available, however it requires that you have more storage available. If you set this value to 0, no examples are stored. NOTE: The `categorization_examples_limit` applies only to analysis that uses categorization.' default: 4.0 type: number model_memory_limit: description: The approximate maximum amount of memory resources that are required for analytical processing. Once this limit is approached, data pruning becomes more aggressive. Upon exceeding this limit, new entities are not modeled. If the `xpack.ml.max_model_memory_limit` setting has a value greater than 0 and less than 1024mb, that value is used instead of the default. The default value is relatively small to ensure that high resource usage is a conscious decision. If you have jobs that are expected to analyze high cardinality fields, you will likely need to use a higher value. If you specify a number instead of a string, the units are assumed to be MiB. Specifying a string is recommended for clarity. If you specify a byte size unit of `b` or `kb` and the number does not equate to a discrete number of megabytes, it is rounded down to the closest MiB. The minimum valid value is 1 MiB. If you specify a value less than 1 MiB, an error occurs. If you specify a value for the `xpack.ml.max_model_memory_limit` setting, an error occurs when you try to create jobs that have `model_memory_limit` values greater than that setting value. default: 1024mb allOf: - $ref: '#/components/schemas/_types.ByteSize' _types.SortOrder: type: string enum: - asc - desc ml._types.CategorizationAnalyzerDefinition: type: object properties: char_filter: description: One or more character filters. In addition to the built-in character filters, other plugins can provide more character filters. If this property is not specified, no character filters are applied prior to categorization. If you are customizing some other aspect of the analyzer and you need to achieve the equivalent of `categorization_filters` (which are not permitted when some other aspect of the analyzer is customized), add them here as pattern replace character filters. type: array items: $ref: '#/components/schemas/_types.analysis.CharFilter' filter: description: One or more token filters. In addition to the built-in token filters, other plugins can provide more token filters. If this property is not specified, no token filters are applied prior to categorization. type: array items: $ref: '#/components/schemas/_types.analysis.TokenFilter' tokenizer: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/tokenizer-reference description: 'The name or definition of the tokenizer to use after character filters are applied. This property is compulsory if `categorization_analyzer` is specified as an object. Machine learning provides a tokenizer called `ml_standard` that tokenizes in a way that has been determined to produce good categorization results on a variety of log file formats for logs in English. If you want to use that tokenizer but change the character or token filters, specify "tokenizer": "ml_standard" in your `categorization_analyzer`. Additionally, the `ml_classic` tokenizer is available, which tokenizes in the same way as the non-customizable tokenizer in old versions of the product (before 6.2). `ml_classic` was the default categorization tokenizer in versions 6.2 to 7.13, so if you need categorization identical to the default for jobs created in these versions, specify "tokenizer": "ml_classic" in your `categorization_analyzer`.' allOf: - $ref: '#/components/schemas/_types.analysis.Tokenizer' _types.analysis.ShingleTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - shingle filler_token: description: String used in shingles as a replacement for empty positions that do not contain a token. This filler token is only used in shingles, not original unigrams. Defaults to an underscore (`_`). type: string max_shingle_size: description: Maximum number of tokens to concatenate when creating shingles. Defaults to `2`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' min_shingle_size: description: Minimum number of tokens to concatenate when creating shingles. Defaults to `2`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' output_unigrams: description: If `true`, the output includes the original input tokens. If `false`, the output only includes shingles; the original input tokens are removed. Defaults to `true`. type: boolean output_unigrams_if_no_shingles: description: If `true`, the output includes the original input tokens only if no shingles are produced; if shingles are produced, the output only includes shingles. Defaults to `false`. type: boolean token_separator: description: Separator used to concatenate adjacent tokens to form a shingle. Defaults to a space (`" "`). type: string required: - type _global.search._types.FieldCollapse: type: object properties: field: description: The field to collapse the result set on allOf: - $ref: '#/components/schemas/_types.Field' inner_hits: description: The number of inner hits and their sort order oneOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' - type: array items: $ref: '#/components/schemas/_global.search._types.InnerHits' max_concurrent_group_searches: description: The number of concurrent requests allowed to retrieve the inner_hits per group type: number collapse: allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' required: - field ml._types.AppliesTo: type: string enum: - actual - typical - diff_from_typical - time _types.analysis.SnowballTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - snowball language: description: Controls the language used by the stemmer. allOf: - $ref: '#/components/schemas/_types.analysis.SnowballLanguage' required: - type _types.query_dsl.ShapeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: When set to `true` the query ignores an unmapped field and will not match any documents. type: boolean _types.SortMode: type: string enum: - min - max - sum - avg - median _types.aggregations.ExtendedStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: sigma: description: The number of standard deviations above/below the mean to display. type: number _types.PinnedRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: Inner retriever. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' ids: type: array items: type: string docs: type: array items: $ref: '#/components/schemas/_types.SpecifiedDocument' rank_window_size: type: number required: - retriever _global.search._types.ScoreMode: type: string enum: - avg - max - min - multiply - total _types.analysis.PhoneticTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - phonetic encoder: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticEncoder' languageset: description: ' Supported values include: `any`, `common`, `cyrillic`, `english`, `french`, `german`, `hebrew`, `hungarian`, `polish`, `romanian`, `russian`, `spanish` ' oneOf: - $ref: '#/components/schemas/_types.analysis.PhoneticLanguage' - type: array items: $ref: '#/components/schemas/_types.analysis.PhoneticLanguage' max_code_len: type: number name_type: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticNameType' replace: type: boolean rule_type: allOf: - $ref: '#/components/schemas/_types.analysis.PhoneticRuleType' required: - type - encoder _types.analysis.SynonymTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilterBase' - type: object properties: type: type: string enum: - synonym required: - type _types.query_dsl.FunctionScoreContainer: allOf: - type: object properties: filter: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' weight: type: number - type: object properties: exp: description: Function that scores a document with a exponential decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' gauss: description: Function that scores a document with a normal decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' linear: description: Function that scores a document with a linear decay, depending on the distance of a numeric field value of the document from an origin. allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunction' field_value_factor: description: 'Function allows you to use a field from a document to influence the score. It’s similar to using the script_score function, however, it avoids the overhead of scripting.' allOf: - $ref: '#/components/schemas/_types.query_dsl.FieldValueFactorScoreFunction' random_score: description: 'Generates scores that are uniformly distributed from 0 up to but not including 1. In case you want scores to be reproducible, it is possible to provide a `seed` and `field`.' allOf: - $ref: '#/components/schemas/_types.query_dsl.RandomScoreFunction' script_score: description: Enables you to wrap another query and customize the scoring of it optionally with a computation derived from other numeric field values in the doc using a script expression. allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptScoreFunction' minProperties: 1 maxProperties: 1 _types.TransportAddress: type: string ml._types.RunningStateSearchInterval: type: object properties: end: description: The end time. allOf: - $ref: '#/components/schemas/_types.Duration' end_ms: description: The end time as an epoch in milliseconds. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' start: description: The start time. allOf: - $ref: '#/components/schemas/_types.Duration' start_ms: description: The start time as an epoch in milliseconds. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' required: - end_ms - start_ms _types.Fuzziness: oneOf: - type: string - type: number _types.aggregations.PercentilesBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: percents: description: The list of percentiles to calculate. type: array items: type: number ml._types.DiscoveryNodeContent: type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' ephemeral_id: allOf: - $ref: '#/components/schemas/_types.Id' transport_address: allOf: - $ref: '#/components/schemas/_types.TransportAddress' external_id: type: string attributes: type: object additionalProperties: type: string roles: type: array items: type: string version: allOf: - $ref: '#/components/schemas/_types.VersionString' min_index_version: type: number max_index_version: type: number required: - ephemeral_id - transport_address - external_id - attributes - roles - version - min_index_version - max_index_version _types.query_dsl.GeoValidationMethod: type: string enum: - coerce - ignore_malformed - strict _types.analysis.PorterStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - porter_stem required: - type _types.EmptyObject: description: For empty Class assignments type: object _global.search._types.Suggester: type: object properties: text: description: Global suggest text, to avoid repetition when the same text is used in several suggesters type: string _types.Ids: oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' _global.search._types.LearningToRank: type: object properties: model_id: description: The unique identifier of the trained model uploaded to Elasticsearch type: string params: description: Named parameters to be passed to the query templates used for feature type: object additionalProperties: type: object required: - model_id ml._types.DetectionRule: type: object properties: actions: description: "The set of actions to be triggered when the rule applies. If more than one action is specified the effects of all actions are combined.\n\nSupported values include:\n - `skip_result`: The result will not be created. Unless you also specify `skip_model_update`, the model will be updated as usual with the corresponding series value.\n - `skip_model_update`: The value for that series will not be used to update the model. Unless you also specify `skip_result`, the results will be created as usual. This action is suitable when certain values are expected to be consistently anomalous and they affect the model in a way that negatively impacts the rest of the results.\n\n" default: - skip_result type: array items: $ref: '#/components/schemas/ml._types.RuleAction' conditions: description: An array of numeric conditions when the rule applies. A rule must either have a non-empty scope or at least one condition. Multiple conditions are combined together with a logical AND. type: array items: $ref: '#/components/schemas/ml._types.RuleCondition' scope: description: A scope of series where the rule applies. A rule must either have a non-empty scope or at least one condition. By default, the scope includes all series. Scoping is allowed for any of the fields that are also specified in `by_field_name`, `over_field_name`, or `partition_field_name`. type: object additionalProperties: $ref: '#/components/schemas/ml._types.FilterRef' _types.analysis.PersianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - persian_stem required: - type _types.TopRightBottomLeftGeoBounds: type: object properties: top_right: allOf: - $ref: '#/components/schemas/_types.GeoLocation' bottom_left: allOf: - $ref: '#/components/schemas/_types.GeoLocation' required: - top_right - bottom_left _types.aggregations.MovingAverageAggregationBase: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: minimize: type: boolean predict: type: number window: type: number _types.analysis.TrimTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - trim required: - type _types.MultiTermQueryRewrite: type: string _types.query_dsl.IntervalsFilter: type: object properties: after: description: Query used to return intervals that follow an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' before: description: Query used to return intervals that occur before an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' contained_by: description: Query used to return intervals contained by an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' containing: description: Query used to return intervals that contain an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_contained_by: description: Query used to return intervals that are **not** contained by an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_containing: description: Query used to return intervals that do **not** contain an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' not_overlapping: description: Query used to return intervals that do **not** overlap with an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' overlapping: description: Query used to return intervals that overlap with an interval from the `filter` rule. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' script: description: 'Script used to return matching documents. This script must return a boolean value: `true` or `false`.' allOf: - $ref: '#/components/schemas/_types.Script' minProperties: 1 maxProperties: 1 _types.query_dsl.SpanQuery: type: object properties: span_containing: description: Accepts a list of span queries, but only returns those spans which also match a second span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanContainingQuery' span_field_masking: description: Allows queries like `span_near` or `span_or` across different fields. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFieldMaskingQuery' span_first: description: Accepts another span query whose matches must appear within the first N positions of the field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFirstQuery' span_gap: allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanGapQuery' span_multi: description: Wraps a `term`, `range`, `prefix`, `wildcard`, `regexp`, or `fuzzy` query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanMultiTermQuery' span_near: description: Accepts multiple span queries whose matches must be within the specified distance of each other, and possibly in the same order. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNearQuery' span_not: description: Wraps another span query, and excludes any documents which match that query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNotQuery' span_or: description: Combines multiple span queries and returns documents which match any of the specified queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanOrQuery' span_term: description: The equivalent of the `term` query but for use with other span queries. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.SpanTermQuery' minProperties: 1 maxProperties: 1 span_within: description: The result from a single span query is returned as long is its span falls within the spans returned by a list of other span queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanWithinQuery' minProperties: 1 maxProperties: 1 _global.search._types.SourceConfig: description: Defines how to fetch a source. Fetching can be disabled entirely, or the source can be filtered. oneOf: - type: boolean - $ref: '#/components/schemas/_global.search._types.SourceFilter' _types.query_dsl.SparseVectorQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-sparse-vector-query allOf: - type: object properties: field: description: 'The name of the field that contains the token-weight pairs to be searched against. This field must be a mapped sparse_vector field.' allOf: - $ref: '#/components/schemas/_types.Field' query: description: 'The query text you want to use for search. If inference_id is specified, query must also be specified.' type: string prune: description: 'Whether to perform pruning, omitting the non-significant tokens from the query to improve query performance. If prune is true but the pruning_config is not specified, pruning will occur but default values will be used. Default: false' x-state: Generally available; Added in 8.15.0 type: boolean pruning_config: description: 'Optional pruning configuration. If enabled, this will omit non-significant tokens from the query in order to improve query performance. This is only used if prune is set to true. If prune is set to true but pruning_config is not specified, default values will be used.' x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - field - type: object properties: query_vector: description: 'Dictionary of precomputed sparse vectors and their associated weights. Only one of inference_id or query_vector may be supplied in a request.' type: object additionalProperties: type: number inference_id: description: 'The inference ID to use to convert the query text into token-weight pairs. It must be the same inference ID that was used to create the tokens from the input text. Only one of inference_id and query_vector is allowed. If inference_id is specified, query must also be specified. Only one of inference_id or query_vector may be supplied in a request.' allOf: - $ref: '#/components/schemas/_types.Id' minProperties: 1 maxProperties: 1 _types.query_dsl.SpanOrQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: clauses: description: Array of one or more other span type queries. type: array items: $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - clauses _types.aggregations.TermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: collect_mode: description: "Determines how child aggregations should be calculated: breadth-first or depth-first.\n\nSupported values include:\n - `depth_first`: Expands all branches of the aggregation tree in one depth-first pass, before any pruning occurs.\n - `breadth_first`: Caches the set of documents that fall into the uppermost buckets for subsequent replay.\n\n" allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationCollectMode' exclude: description: 'Values to exclude. Accepts regular expressions and partitions.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: Determines whether the aggregation will use field values directly or global ordinals. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return terms. allOf: - $ref: '#/components/schemas/_types.Field' include: description: 'Values to include. Accepts regular expressions and partitions.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' min_doc_count: description: Only return values that are found in more than `min_doc_count` hits. default: 1.0 type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' missing_order: allOf: - $ref: '#/components/schemas/_types.aggregations.MissingOrder' missing_bucket: type: boolean value_type: description: Coerced unmapped fields into the specified type. type: string order: description: 'Specifies the sort order of the buckets. Defaults to sorting by descending document count.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' shard_min_doc_count: description: 'Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`. Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number show_term_doc_count_error: description: Set to `true` to return the `doc_count_error_upper_bound`, which is an upper bound to the error on the `doc_count` returned by each shard. type: boolean size: description: The number of buckets returned out of the overall terms list. default: 10.0 type: number format: type: string _types.aggregations.PValueHeuristic: type: object properties: background_is_superset: type: boolean normalize_above: description: 'Should the results be normalized when above the given value. Allows for consistent significance results at various scales. Note: `0` is a special value which means no normalization' default: 0.0 type: number _types.query_dsl.SpanWithinQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: big: description: 'Can be any span query. Matching spans from `little` that are enclosed within `big` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' little: description: 'Can be any span query. Matching spans from `little` that are enclosed within `big` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - big - little _types.query_dsl.IntervalsAllOf: type: object properties: intervals: description: An array of rules to combine. All rules must produce a match in a document for the overall source to match. type: array items: $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' max_gaps: description: 'Maximum number of positions between the matching terms. Intervals produced by the rules further apart than this are not considered matches.' default: -1.0 type: number ordered: description: If `true`, intervals produced by the rules should appear in the order in which they are specified. default: false type: boolean filter: description: Rule used to filter returned intervals. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - intervals _types.query_dsl.DisMaxQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: queries: description: 'One or more query clauses. Returned documents must match one or more of these queries. If a document matches multiple queries, Elasticsearch uses the highest relevance score.' type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' tie_breaker: description: Floating point number between 0 and 1.0 used to increase the relevance scores of documents matching multiple query clauses. default: 0.0 type: number required: - queries _types.SortOptions: type: object properties: _score: allOf: - $ref: '#/components/schemas/_types.ScoreSort' _doc: allOf: - $ref: '#/components/schemas/_types.ScoreSort' _geo_distance: allOf: - $ref: '#/components/schemas/_types.GeoDistanceSort' _script: allOf: - $ref: '#/components/schemas/_types.ScriptSort' minProperties: 1 maxProperties: 1 _types.query_dsl.IntervalsWildcard: type: object properties: analyzer: description: 'Analyzer used to analyze the `pattern`. Defaults to the top-level field''s analyzer.' type: string pattern: description: Wildcard pattern used to find matching terms. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `pattern` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - pattern _types.mapping.CompositeSubField: type: object properties: type: allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFieldType' required: - type _types.analysis.SimplePatternTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - simple_pattern pattern: type: string required: - type _types.analysis.KeywordMarkerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keyword_marker ignore_case: description: If `true`, matching for the `keywords` and `keywords_path` parameters ignores letter case. Defaults to `false`. type: boolean keywords: description: 'Array of keywords. Tokens that match these keywords are not stemmed. This parameter, `keywords_path`, or `keywords_pattern` must be specified. You cannot specify this parameter and `keywords_pattern`.' oneOf: - type: string - type: array items: type: string keywords_path: description: 'Path to a file that contains a list of keywords. Tokens that match these keywords are not stemmed. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each word in the file must be separated by a line break. This parameter, `keywords`, or `keywords_pattern` must be specified. You cannot specify this parameter and `keywords_pattern`.' type: string keywords_pattern: description: 'Java regular expression used to match tokens. Tokens that match this expression are marked as keywords and not stemmed. This parameter, `keywords`, or `keywords_path` must be specified. You cannot specify this parameter and `keywords` or `keywords_pattern`.' type: string required: - type _types.DurationValueUnitFloatMillis: allOf: - $ref: '#/components/schemas/_types.UnitFloatMillis' _types.analysis.TokenFilterBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.LatLonGeoLocation: type: object properties: lat: description: Latitude type: number lon: description: Longitude type: number required: - lat - lon _types.aggregations.GeoLineSort: type: object properties: field: description: The name of the numeric field to use as the sort key for ordering the points. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.query_dsl.SemanticQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: The field to query, which must be a semantic_text field type type: string query: description: The query text type: string required: - field - query _types.query_dsl.UntypedRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBase' - type: object properties: format: description: Date format used to convert `date` values in the query. allOf: - $ref: '#/components/schemas/_types.DateFormat' time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert `date` values in the query to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' _types.aggregations.HoltWintersModelSettings: type: object properties: alpha: type: number beta: type: number gamma: type: number pad: type: boolean period: type: number type: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltWintersType' ml._types.DetectorRead: type: object properties: by_field_name: description: 'The field used to split the data. In particular, this property is used for analyzing the splits with respect to their own history. It is used for finding unusual values in the context of the split.' allOf: - $ref: '#/components/schemas/_types.Field' custom_rules: description: 'An array of custom rule objects, which enable you to customize the way detectors operate. For example, a rule may dictate to the detector conditions under which results should be skipped. Kibana refers to custom rules as job rules.' type: array items: $ref: '#/components/schemas/ml._types.DetectionRule' detector_description: description: A description of the detector. type: string detector_index: description: 'A unique identifier for the detector. This identifier is based on the order of the detectors in the `analysis_config`, starting at zero.' type: number exclude_frequent: description: 'Contains one of the following values: `all`, `none`, `by`, or `over`. If set, frequent entities are excluded from influencing the anomaly results. Entities can be considered frequent over time or frequent in a population. If you are working with both over and by fields, then you can set `exclude_frequent` to all for both fields, or to `by` or `over` for those specific fields.' allOf: - $ref: '#/components/schemas/ml._types.ExcludeFrequent' field_name: description: 'The field that the detector uses in the function. If you use an event rate function such as `count` or `rare`, do not specify this field.' allOf: - $ref: '#/components/schemas/_types.Field' function: description: 'The analysis function that is used. For example, `count`, `rare`, `mean`, `min`, `max`, and `sum`.' type: string over_field_name: description: 'The field used to split the data. In particular, this property is used for analyzing the splits with respect to the history of all splits. It is used for finding unusual values in the population of all splits.' allOf: - $ref: '#/components/schemas/_types.Field' partition_field_name: description: 'The field used to segment the analysis. When you use this property, you have completely independent baselines for each value of this field.' allOf: - $ref: '#/components/schemas/_types.Field' use_null: description: Defines whether a new series is used as the null series when there is no value for the by or partition fields. default: false type: boolean required: - function _types.analysis.KuromojiPartOfSpeechTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_part_of_speech stoptags: type: array items: type: string required: - type - stoptags _types.aggregations.TTestAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: a: description: Test population A. allOf: - $ref: '#/components/schemas/_types.aggregations.TestPopulation' b: description: Test population B. allOf: - $ref: '#/components/schemas/_types.aggregations.TestPopulation' type: description: "The type of test.\n\nSupported values include:\n - `paired`: Performs paired t-test.\n - `homoscedastic`: Performs two-sample equal variance test.\n - `heteroscedastic`: Performs two-sample unequal variance test.\n\n" default: heteroscedastic allOf: - $ref: '#/components/schemas/_types.aggregations.TTestType' _types.analysis.CompoundWordTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: max_subword_size: description: Maximum subword character length. Longer subword tokens are excluded from the output. Defaults to `15`. type: number min_subword_size: description: Minimum subword character length. Shorter subword tokens are excluded from the output. Defaults to `2`. type: number min_word_size: description: Minimum word character length. Shorter word tokens are excluded from the output. Defaults to `5`. type: number only_longest_match: description: If `true`, only include the longest matching subword. Defaults to `false`. type: boolean word_list: description: 'A list of subwords to look for in the token stream. If found, the subword is included in the token output. Either this parameter or `word_list_path` must be specified.' type: array items: type: string word_list_path: description: 'Path to a file that contains a list of subwords to find in the token stream. If found, the subword is included in the token output. This path must be absolute or relative to the config location, and the file must be UTF-8 encoded. Each token in the file must be separated by a line break. Either this parameter or `word_list` must be specified.' type: string _types.query_dsl.DateRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBaseDateMath' - type: object properties: format: description: Date format used to convert `date` values in the query. allOf: - $ref: '#/components/schemas/_types.DateFormat' time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert `date` values in the query to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' _global.search._types.HighlighterFragmenter: type: string enum: - simple - span _types.aggregations.TDigest: type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' _types.ScoreNormalizer: type: string enum: - none - minmax - l2_norm ml._types.BucketInfluencer: type: object properties: anomaly_score: description: 'A normalized score between 0-100, which is calculated for each bucket influencer. This score might be updated as newer data is analyzed.' type: number bucket_span: description: The length of the bucket in seconds. This value matches the bucket span that is specified in the job. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitSeconds' influencer_field_name: description: The field name of the influencer. allOf: - $ref: '#/components/schemas/_types.Field' initial_anomaly_score: description: 'The score between 0-100 for each bucket influencer. This score is the initial value that was calculated at the time the bucket was processed.' type: number is_interim: description: If true, this is an interim result. In other words, the results are calculated based on partial input data. type: boolean job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' probability: description: 'The probability that the bucket has this behavior, in the range 0 to 1. This value can be held to a high precision of over 300 decimal places, so the `anomaly_score` is provided as a human-readable and friendly interpretation of this.' type: number raw_anomaly_score: description: Internal. type: number result_type: description: Internal. This value is always set to `bucket_influencer`. type: string timestamp: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' timestamp_string: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.DateTime' required: - anomaly_score - bucket_span - influencer_field_name - initial_anomaly_score - is_interim - job_id - probability - raw_anomaly_score - result_type - timestamp _types.analysis.KuromojiStemmerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_stemmer minimum_length: type: number required: - type - minimum_length _types.analysis.ReverseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - reverse required: - type _types.analysis.NoriDecompoundMode: type: string enum: - discard - none - mixed _types.query_dsl.CommonTermsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: type: string cutoff_frequency: type: number high_freq_operator: allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' low_freq_operator: allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' minimum_should_match: allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' query: type: string required: - query _types.query_dsl.RankFeatureFunctionSigmoid: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: pivot: description: Configurable pivot value so that the result will be less than 0.5. type: number exponent: description: Configurable Exponent. type: number required: - pivot - exponent _types.analysis.MultiplexerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - multiplexer filters: description: A list of token filters to apply to incoming tokens. type: array items: type: string preserve_original: description: If `true` (the default) then emit the original token in addition to the filtered tokens. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type - filters _types.analysis.TokenizerDefinition: discriminator: propertyName: type mapping: char_group: '#/components/schemas/_types.analysis.CharGroupTokenizer' classic: '#/components/schemas/_types.analysis.ClassicTokenizer' edge_ngram: '#/components/schemas/_types.analysis.EdgeNGramTokenizer' icu_tokenizer: '#/components/schemas/_types.analysis.IcuTokenizer' keyword: '#/components/schemas/_types.analysis.KeywordTokenizer' kuromoji_tokenizer: '#/components/schemas/_types.analysis.KuromojiTokenizer' letter: '#/components/schemas/_types.analysis.LetterTokenizer' lowercase: '#/components/schemas/_types.analysis.LowercaseTokenizer' ngram: '#/components/schemas/_types.analysis.NGramTokenizer' nori_tokenizer: '#/components/schemas/_types.analysis.NoriTokenizer' path_hierarchy: '#/components/schemas/_types.analysis.PathHierarchyTokenizer' pattern: '#/components/schemas/_types.analysis.PatternTokenizer' simple_pattern: '#/components/schemas/_types.analysis.SimplePatternTokenizer' simple_pattern_split: '#/components/schemas/_types.analysis.SimplePatternSplitTokenizer' standard: '#/components/schemas/_types.analysis.StandardTokenizer' thai: '#/components/schemas/_types.analysis.ThaiTokenizer' uax_url_email: '#/components/schemas/_types.analysis.UaxEmailUrlTokenizer' whitespace: '#/components/schemas/_types.analysis.WhitespaceTokenizer' oneOf: - $ref: '#/components/schemas/_types.analysis.CharGroupTokenizer' - $ref: '#/components/schemas/_types.analysis.ClassicTokenizer' - $ref: '#/components/schemas/_types.analysis.EdgeNGramTokenizer' - $ref: '#/components/schemas/_types.analysis.KeywordTokenizer' - $ref: '#/components/schemas/_types.analysis.LetterTokenizer' - $ref: '#/components/schemas/_types.analysis.LowercaseTokenizer' - $ref: '#/components/schemas/_types.analysis.NGramTokenizer' - $ref: '#/components/schemas/_types.analysis.PathHierarchyTokenizer' - $ref: '#/components/schemas/_types.analysis.PatternTokenizer' - $ref: '#/components/schemas/_types.analysis.SimplePatternTokenizer' - $ref: '#/components/schemas/_types.analysis.SimplePatternSplitTokenizer' - $ref: '#/components/schemas/_types.analysis.StandardTokenizer' - $ref: '#/components/schemas/_types.analysis.ThaiTokenizer' - $ref: '#/components/schemas/_types.analysis.UaxEmailUrlTokenizer' - $ref: '#/components/schemas/_types.analysis.WhitespaceTokenizer' - $ref: '#/components/schemas/_types.analysis.IcuTokenizer' - $ref: '#/components/schemas/_types.analysis.KuromojiTokenizer' - $ref: '#/components/schemas/_types.analysis.NoriTokenizer' _types.aggregations.GeoTileGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geotile_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: 'Integer zoom of the key used to define cells/buckets in the results. Values outside of the range [0,29] will be rejected.' default: '7' allOf: - $ref: '#/components/schemas/_types.GeoTilePrecision' shard_size: description: 'Allows for more accurate counting of the top cells returned in the final result the aggregation. Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.' type: number size: description: The maximum number of buckets to return. default: 10000.0 type: number bounds: description: A bounding box to filter the geo-points or geo-shapes in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' _types.aggregations.Aggregation: type: object _types.aggregations.AverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.query_dsl.FunctionScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: boost_mode: description: "Defines how he newly computed score is combined with the score of the query\n\nSupported values include:\n - `multiply`: Query score and function score are multiplied\n - `replace`: Only the function score is used.\nThe query score is ignored.\n - `sum`: Query score and function score are added\n - `avg`: Query score and function score are averaged\n - `max`: Max of query score and function score\n - `min`: Min of query score and function score\n\n" default: multiply allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionBoostMode' functions: description: One or more functions that compute a new score for each document returned by the query. type: array items: $ref: '#/components/schemas/_types.query_dsl.FunctionScoreContainer' max_boost: description: Restricts the new score to not exceed the provided limit. type: number min_score: description: Excludes documents that do not meet the provided score threshold. type: number query: description: A query that determines the documents for which a new score is computed. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: "Specifies how the computed scores are combined\n\nSupported values include:\n - `multiply`: Scores are multiplied.\n - `sum`: Scores are summed.\n - `avg`: Scores are averaged.\n - `first`: The first function that has a matching filter is applied.\n - `max`: Maximum score is used.\n - `min`: Minimum score is used.\n\n" default: multiply allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionScoreMode' _types.aggregations.MedianAbsoluteDeviationAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. default: 1000.0 type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' _types.analysis.RemoveDuplicatesTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - remove_duplicates required: - type _types.aggregations.MinimumInterval: type: string enum: - second - minute - hour - day - month - year _types.query_dsl.SimpleQueryStringFlag: type: string enum: - NONE - AND - NOT - OR - PREFIX - PHRASE - PRECEDENCE - ESCAPE - WHITESPACE - FUZZY - NEAR - SLOP - ALL _types.HttpHeaders: type: object additionalProperties: oneOf: - type: string - type: array items: type: string _types.query_dsl.RangeQuery: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-range-query oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.DateRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.NumberRangeQuery' - $ref: '#/components/schemas/_types.query_dsl.TermRangeQuery' ml._types.JobState: type: string enum: - closing - closed - opened - failed - opening _types.aggregations.DateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: calendar_interval: description: 'Calendar-aware interval. Can be specified using the unit name, such as `month`, or as a single unit quantity, such as `1M`.' allOf: - $ref: '#/components/schemas/_types.aggregations.CalendarInterval' extended_bounds: description: Enables extending the bounds of the histogram beyond the data itself. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsFieldDateMath' hard_bounds: description: Limits the histogram to specified bounds. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsFieldDateMath' field: description: The date field whose values are use to build a histogram. allOf: - $ref: '#/components/schemas/_types.Field' fixed_interval: description: 'Fixed intervals: a fixed number of SI units and never deviate, regardless of where they fall on the calendar.' allOf: - $ref: '#/components/schemas/_types.Duration' format: description: 'The date format used to format `key_as_string` in the response. If no `format` is specified, the first date format specified in the field mapping is used.' type: string interval: deprecated: true allOf: - $ref: '#/components/schemas/_types.Duration' min_doc_count: description: 'Only returns buckets that have `min_doc_count` number of documents. By default, all buckets between the first bucket that matches documents and the last one are returned.' type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.DateTime' offset: description: Changes the start value of each bucket by the specified positive (`+`) or negative offset (`-`) duration. allOf: - $ref: '#/components/schemas/_types.Duration' order: description: The sort order of the returned buckets. allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' params: type: object additionalProperties: type: object script: allOf: - $ref: '#/components/schemas/_types.Script' time_zone: description: 'Time zone used for bucketing and rounding. Defaults to Coordinated Universal Time (UTC).' allOf: - $ref: '#/components/schemas/_types.TimeZone' keyed: description: Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array. type: boolean _types.aggregations.TermsExclude: oneOf: - type: string - type: array items: type: string _types.aggregations.CategorizeTextAnalyzer: oneOf: - type: string - $ref: '#/components/schemas/_types.aggregations.CustomCategorizeTextAnalyzer' _types.query_dsl.DistanceFeatureQueryBaseGeoLocationDistance: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' allOf: - $ref: '#/components/schemas/_types.GeoLocation' pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' allOf: - $ref: '#/components/schemas/_types.Distance' field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field _types.aggregations.TopHitsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: docvalue_fields: description: Fields for which to return doc values. type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' explain: description: If `true`, returns detailed information about score computation as part of a hit. default: false type: boolean fields: description: 'Array of wildcard (*) patterns. The request returns values for field names matching these patterns in the hits.fields property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' from: description: Starting document offset. default: 0.0 type: number highlight: description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in the search results. allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' script_fields: description: Returns the result of one or more script evaluations for each hit. type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' size: description: The maximum number of top matching hits to return per bucket. default: 3.0 type: number sort: description: 'Sort order of the top matching hits. By default, the hits are sorted by the score of the main query.' allOf: - $ref: '#/components/schemas/_types.Sort' _source: description: Selects the fields of the source that are returned. allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' stored_fields: description: Returns values for the specified stored fields (fields that use the `store` mapping option). allOf: - $ref: '#/components/schemas/_types.Fields' track_scores: description: If `true`, calculates and returns document scores, even if the scores are not used for sorting. default: false type: boolean version: description: If `true`, returns document version as part of a hit. default: false type: boolean seq_no_primary_term: description: If `true`, returns sequence number and primary term of the last modification of each hit. type: boolean _types.query_dsl.DecayFunctionBaseGeoLocationDistance: type: object properties: multi_value_mode: description: "Determines how the distance is calculated when a field used for computing the decay contains multiple values.\n\nSupported values include:\n - `min`: Distance is the minimum distance.\n - `max`: Distance is the maximum distance.\n - `avg`: Distance is the average distance.\n - `sum`: Distance is the sum of all distances.\n\n" default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.ScoreSort: type: object properties: order: description: "\n\nSupported values include:\n - `asc`: Ascending (smallest to largest)\n - `desc`: Descending (largest to smallest)\n\n" allOf: - $ref: '#/components/schemas/_types.SortOrder' _types.GeoDistanceSort: type: object properties: mode: allOf: - $ref: '#/components/schemas/_types.SortMode' distance_type: description: "\n\nSupported values include:\n - `arc`: The `arc` calculation is the most accurate.\n - `plane`: The `plane` calculation is faster but less accurate.\n\n" allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' ignore_unmapped: type: boolean order: description: "\n\nSupported values include:\n - `asc`: Ascending (smallest to largest)\n - `desc`: Descending (largest to smallest)\n\n" allOf: - $ref: '#/components/schemas/_types.SortOrder' unit: allOf: - $ref: '#/components/schemas/_types.DistanceUnit' nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' _types.EpochTimeUnitMillis: allOf: - $ref: '#/components/schemas/_types.UnitMillis' _types.analysis.PatternReplaceTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - pattern_replace all: description: If `true`, all substrings matching the pattern parameter’s regular expression are replaced. If `false`, the filter replaces only the first matching substring in each token. Defaults to `true`. type: boolean flags: type: string pattern: description: Regular expression, written in Java’s regular expression syntax. The filter replaces token substrings matching this pattern with the substring in the `replacement` parameter. type: string replacement: description: Replacement substring. Defaults to an empty substring (`""`). type: string required: - type - pattern _types.aggregations.AggregationRange: type: object properties: from: description: Start of the range (inclusive). oneOf: - type: number - type: - string - 'null' key: description: Custom key to return the range with. type: string to: description: End of the range (exclusive). oneOf: - type: number - type: - string - 'null' _types.aggregations.InferenceAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: model_id: description: The ID or alias for the trained model. allOf: - $ref: '#/components/schemas/_types.Name' inference_config: description: Contains the inference type and its options. allOf: - $ref: '#/components/schemas/_types.aggregations.InferenceConfigContainer' required: - model_id _types.analysis.IcuNormalizationMode: type: string enum: - decompose - compose _types.query_dsl.IntervalsContainer: type: object properties: all_of: description: Returns matches that span a combination of other rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAllOf' any_of: description: Returns intervals produced by any of its sub-rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAnyOf' fuzzy: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFuzzy' match: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsMatch' prefix: description: Matches terms that start with a specified set of characters. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsPrefix' range: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRange' regexp: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRegexp' wildcard: description: Matches terms using a wildcard pattern. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsWildcard' minProperties: 1 maxProperties: 1 _types.query_dsl.FunctionScoreMode: type: string enum: - multiply - sum - avg - first - max - min _types.SpecifiedDocument: type: object properties: index: allOf: - $ref: '#/components/schemas/_types.IndexName' id: allOf: - $ref: '#/components/schemas/_types.Id' required: - id _types.query_dsl.RankFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: '`rank_feature` or `rank_features` field used to boost relevance scores.' allOf: - $ref: '#/components/schemas/_types.Field' saturation: description: Saturation function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionSaturation' log: description: Logarithmic function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionLogarithm' linear: description: Linear function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionLinear' sigmoid: description: Sigmoid function used to boost relevance scores based on the value of the rank feature `field`. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunctionSigmoid' required: - field _types.analysis.DecimalDigitTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - decimal_digit required: - type _spec_utils.Stringifiedboolean: description: 'Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type. Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.' oneOf: - type: boolean - type: string _types.aggregations.GeoBoundsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: wrap_longitude: description: Specifies whether the bounding box should be allowed to overlap the international date line. default: true type: boolean _types.query_dsl.ScriptQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: script: description: 'Contains a script to run as a query. This script must return a boolean value, `true` or `false`.' allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.analysis.PersianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - persian_normalization required: - type _types.analysis.PhoneticLanguage: type: string enum: - any - common - cyrillic - english - french - german - hebrew - hungarian - polish - romanian - russian - spanish _types.analysis.UaxEmailUrlTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - uax_url_email max_token_length: type: number required: - type _types.analysis.UniqueTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - unique only_on_same_position: description: If `true`, only remove duplicate tokens in the same position. Defaults to `false`. type: boolean required: - type _types.analysis.ArabicStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - arabic_stem required: - type _types.analysis.CommonGramsTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - common_grams common_words: description: 'A list of tokens. The filter generates bigrams for these tokens. Either this or the `common_words_path` parameter is required.' type: array items: type: string common_words_path: description: 'Path to a file containing a list of tokens. The filter generates bigrams for these tokens. This path must be absolute or relative to the `config` location. The file must be UTF-8 encoded. Each token in the file must be separated by a line break. Either this or the `common_words` parameter is required.' type: string ignore_case: description: If `true`, matches for common words matching are case-insensitive. Defaults to `false`. type: boolean query_mode: description: 'If `true`, the filter excludes the following tokens from the output: - Unigrams for common words - Unigrams for terms followed by common words Defaults to `false`. We recommend enabling this parameter for search analyzers.' type: boolean required: - type _types.query_dsl.FieldValueFactorScoreFunction: type: object properties: field: description: Field to be extracted from the document. allOf: - $ref: '#/components/schemas/_types.Field' factor: description: Optional factor to multiply the field value with. default: 1.0 type: number missing: description: 'Value used if the document doesn’t have that field. The modifier and factor are still applied to it as though it were read from the document.' type: number modifier: description: "Modifier to apply to the field value.\n\nSupported values include:\n - `none`: Do not apply any multiplier to the field value.\n - `log`: Take the common logarithm of the field value.\nBecause this function will return a negative value and cause an error if used on values between 0 and 1, it is recommended to use `log1p` instead.\n - `log1p`: Add 1 to the field value and take the common logarithm.\n - `log2p`: Add 2 to the field value and take the common logarithm.\n - `ln`: Take the natural logarithm of the field value.\nBecause this function will return a negative value and cause an error if used on values between 0 and 1, it is recommended to use `ln1p` instead.\n - `ln1p`: Add 1 to the field value and take the natural logarithm.\n - `ln2p`: Add 2 to the field value and take the natural logarithm.\n - `square`: Square the field value (multiply it by itself).\n - `sqrt`: Take the square root of the field value.\n - `reciprocal`: Reciprocate the field value, same as `1/x` where `x` is the field’s value.\n\n" allOf: - $ref: '#/components/schemas/_types.query_dsl.FieldValueFactorModifier' required: - field _types.analysis.IndicNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - indic_normalization required: - type _types.analysis.KuromojiIterationMarkCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - kuromoji_iteration_mark normalize_kana: type: boolean normalize_kanji: type: boolean required: - type - normalize_kana - normalize_kanji _types.aggregations.MultiTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: collect_mode: description: "Specifies the strategy for data collection.\n\nSupported values include:\n - `depth_first`: Expands all branches of the aggregation tree in one depth-first pass, before any pruning occurs.\n - `breadth_first`: Caches the set of documents that fall into the uppermost buckets for subsequent replay.\n\n" default: breadth_first allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationCollectMode' order: description: 'Specifies the sort order of the buckets. Defaults to sorting by descending document count.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' min_doc_count: description: The minimum number of documents in a bucket for it to be returned. default: 1.0 type: number shard_min_doc_count: description: The minimum number of documents in a bucket on each shard for it to be returned. default: 1.0 type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number show_term_doc_count_error: description: Calculates the doc count error on per term basis. default: false type: boolean size: description: The number of term buckets should be returned out of the overall terms list. default: 10.0 type: number terms: description: The field from which to generate sets of terms. type: array items: $ref: '#/components/schemas/_types.aggregations.MultiTermLookup' required: - terms ml._types.ModelPlotConfig: type: object properties: annotations_enabled: description: If true, enables calculation and storage of the model change annotations for each entity that is being analyzed. default: true x-state: Generally available; Added in 7.9.0 type: boolean enabled: description: If true, enables calculation and storage of the model bounds for each entity that is being analyzed. default: false type: boolean terms: description: Limits data collection to this comma separated list of partition or by field values. If terms are not specified or it is an empty string, no filtering is applied. Wildcards are not supported. Only the specified terms can be viewed when using the Single Metric Viewer. x-state: Generally available; Added in 7.9.0 allOf: - $ref: '#/components/schemas/_types.Field' _types.TimeZone: type: string _types.query_dsl.DistanceFeatureQuery: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-distance-feature-query oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedDistanceFeatureQuery' - $ref: '#/components/schemas/_types.query_dsl.GeoDistanceFeatureQuery' - $ref: '#/components/schemas/_types.query_dsl.DateDistanceFeatureQuery' _types.aggregations.ReverseNestedAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: path: description: 'Defines the nested object field that should be joined back to. The default is empty, which means that it joins back to the root/main document level.' allOf: - $ref: '#/components/schemas/_types.Field' _types.aggregations.MovingPercentilesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: window: description: The size of window to "slide" across the histogram. type: number shift: description: 'By default, the window consists of the last n values excluding the current bucket. Increasing `shift` by 1, moves the starting window position by 1 to the right.' default: 0.0 type: number keyed: type: boolean _types.aggregations.CompositeAggregationBase: type: object properties: field: description: Either `field` or `script` must be present allOf: - $ref: '#/components/schemas/_types.Field' missing_bucket: type: boolean missing_order: allOf: - $ref: '#/components/schemas/_types.aggregations.MissingOrder' script: description: Either `field` or `script` must be present allOf: - $ref: '#/components/schemas/_types.Script' value_type: allOf: - $ref: '#/components/schemas/_types.aggregations.ValueType' order: description: "\n\nSupported values include:\n - `asc`: Ascending (smallest to largest)\n - `desc`: Descending (largest to smallest)\n\n" allOf: - $ref: '#/components/schemas/_types.SortOrder' _types.aggregations.SerialDifferencingAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: lag: description: 'The historical bucket to subtract from the current value. Must be a positive, non-zero integer.' type: number _types.mapping.RuntimeFields: type: object additionalProperties: $ref: '#/components/schemas/_types.mapping.RuntimeField' _types.KnnQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: description: The name of the vector field to search against allOf: - $ref: '#/components/schemas/_types.Field' query_vector: description: The query vector allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: The query vector builder. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' num_candidates: description: The number of nearest neighbor candidates to consider per shard type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number k: description: The final number of nearest neighbors to return as top hits type: number filter: description: Filters for the kNN search query oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' similarity: description: The minimum similarity for a vector to be considered a match type: number rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' required: - field _types.query_dsl.QueryContainer: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl description: An Elasticsearch Query DSL (Domain Specific Language) object that defines a query. type: object properties: bool: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-bool-query description: matches documents matching boolean combinations of other queries. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoolQuery' boosting: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-boosting-query description: Returns documents matching a `positive` query while reducing the relevance score of documents that also match a `negative` query. allOf: - $ref: '#/components/schemas/_types.query_dsl.BoostingQuery' common: deprecated: true type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.CommonTermsQuery' minProperties: 1 maxProperties: 1 combined_fields: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-combined-fields-query description: The `combined_fields` query supports searching multiple text fields as if their contents had been indexed into one combined field. x-state: Generally available; Added in 7.13.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsQuery' constant_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-constant-score-query description: Wraps a filter query and returns every matching document with a relevance score equal to the `boost` parameter value. allOf: - $ref: '#/components/schemas/_types.query_dsl.ConstantScoreQuery' dis_max: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-dis-max-query description: 'Returns documents matching one or more wrapped queries, called query clauses or clauses. If a returned document matches multiple query clauses, the `dis_max` query assigns the document the highest relevance score from any matching clause, plus a tie breaking increment for any additional matching subqueries.' allOf: - $ref: '#/components/schemas/_types.query_dsl.DisMaxQuery' distance_feature: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-distance-feature-query description: 'Boosts the relevance score of documents closer to a provided origin date or point. For example, you can use this query to give more weight to documents closer to a certain date or location.' allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQuery' exists: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-exists-query description: Returns documents that contain an indexed value for a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.ExistsQuery' function_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-function-score-query description: The `function_score` enables you to modify the score of documents that are retrieved by a query. allOf: - $ref: '#/components/schemas/_types.query_dsl.FunctionScoreQuery' fuzzy: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-fuzzy-query description: Returns documents that contain terms similar to the search term, as measured by a Levenshtein edit distance. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.FuzzyQuery' minProperties: 1 maxProperties: 1 geo_bounding_box: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-bounding-box-query description: Matches geo_point and geo_shape values that intersect a bounding box. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoBoundingBoxQuery' geo_distance: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-distance-query description: Matches `geo_point` and `geo_shape` values within a given distance of a geopoint. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoDistanceQuery' geo_grid: description: Matches `geo_point` and `geo_shape` values that intersect a grid cell from a GeoGrid aggregation. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.GeoGridQuery' minProperties: 1 maxProperties: 1 geo_polygon: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoPolygonQuery' geo_shape: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-geo-shape-query description: Filter documents indexed using either the `geo_shape` or the `geo_point` type. allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoShapeQuery' has_child: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-has-child-query description: Returns parent documents whose joined child documents match a provided query. allOf: - $ref: '#/components/schemas/_types.query_dsl.HasChildQuery' has_parent: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-has-parent-query description: Returns child documents whose joined parent document matches a provided query. allOf: - $ref: '#/components/schemas/_types.query_dsl.HasParentQuery' ids: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-ids-query description: 'Returns documents based on their IDs. This query uses document IDs stored in the `_id` field.' allOf: - $ref: '#/components/schemas/_types.query_dsl.IdsQuery' intervals: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-intervals-query description: Returns documents based on the order and proximity of matching terms. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.IntervalsQuery' minProperties: 1 maxProperties: 1 knn: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-knn-query description: 'Finds the k nearest vectors to a query vector, as measured by a similarity metric. knn query finds nearest vectors through approximate search on indexed dense_vectors.' allOf: - $ref: '#/components/schemas/_types.KnnQuery' match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query description: 'Returns documents that match a provided text, number, date or boolean value. The provided text is analyzed before matching.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchQuery' minProperties: 1 maxProperties: 1 match_all: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-all-query description: Matches all documents, giving them all a `_score` of 1.0. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchAllQuery' match_bool_prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-bool-prefix-query description: 'Analyzes its input and constructs a `bool` query from the terms. Each term except the last is used in a `term` query. The last term is used in a prefix query.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchBoolPrefixQuery' minProperties: 1 maxProperties: 1 match_none: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-all-query#query-dsl-match-none-query description: Matches no documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.MatchNoneQuery' match_phrase: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query-phrase description: Analyzes the text and creates a phrase query out of the analyzed text. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchPhraseQuery' minProperties: 1 maxProperties: 1 match_phrase_prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-match-query-phrase-prefix description: 'Returns documents that contain the words of a provided text, in the same order as provided. The last term of the provided text is treated as a prefix, matching any words that begin with that term.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.MatchPhrasePrefixQuery' minProperties: 1 maxProperties: 1 more_like_this: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-mlt-query description: Returns documents that are "like" a given set of documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.MoreLikeThisQuery' multi_match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-multi-match-query description: 'Enables you to search for a provided text, number, date or boolean value across multiple fields. The provided text is analyzed before matching.' allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiMatchQuery' nested: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-nested-query description: 'Wraps another query to search nested fields. If an object matches the search, the nested query returns the root parent document.' allOf: - $ref: '#/components/schemas/_types.query_dsl.NestedQuery' parent_id: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-parent-id-query description: Returns child documents joined to a specific parent document. allOf: - $ref: '#/components/schemas/_types.query_dsl.ParentIdQuery' percolate: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-percolate-query description: Matches queries stored in an index. allOf: - $ref: '#/components/schemas/_types.query_dsl.PercolateQuery' pinned: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-pinned-query description: Promotes selected documents to rank higher than those matching a given query. allOf: - $ref: '#/components/schemas/_types.query_dsl.PinnedQuery' prefix: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-prefix-query description: Returns documents that contain a specific prefix in a provided field. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.PrefixQuery' minProperties: 1 maxProperties: 1 query_string: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-query-string-query description: Returns documents based on a provided query string, using a parser with a strict syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryStringQuery' range: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-range-query description: Returns documents that contain terms within a provided range. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RangeQuery' minProperties: 1 maxProperties: 1 rank_feature: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-rank-feature-query description: Boosts the relevance score of documents based on the numeric value of a `rank_feature` or `rank_features` field. allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureQuery' regexp: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-regexp-query description: Returns documents that contain terms matching a regular expression. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.RegexpQuery' minProperties: 1 maxProperties: 1 rule: allOf: - $ref: '#/components/schemas/_types.query_dsl.RuleQuery' script: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-script-query description: 'Filters documents based on a provided script. The script query is typically used in a filter context.' allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptQuery' script_score: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-script-score-query description: Uses a script to provide a custom score for returned documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.ScriptScoreQuery' semantic: description: A semantic query to semantic_text field types x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.SemanticQuery' shape: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-shape-query description: Queries documents that contain fields indexed using the `shape` type. allOf: - $ref: '#/components/schemas/_types.query_dsl.ShapeQuery' simple_query_string: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query description: Returns documents based on a provided query string, using a parser with a limited but fault-tolerant syntax. allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringQuery' span_containing: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-containing-query description: Returns matches which enclose another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanContainingQuery' span_field_masking: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-field-masking-query description: Wrapper to allow span queries to participate in composite single-field span queries by _lying_ about their search field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFieldMaskingQuery' span_first: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-first-query description: Matches spans near the beginning of a field. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanFirstQuery' span_multi: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-multi-term-query description: Allows you to wrap a multi term query (one of `wildcard`, `fuzzy`, `prefix`, `range`, or `regexp` query) as a `span` query, so it can be nested. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanMultiTermQuery' span_near: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-near-query description: 'Matches spans which are near one another. You can specify `slop`, the maximum number of intervening unmatched positions, as well as whether matches are required to be in-order.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNearQuery' span_not: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-not-query description: Removes matches which overlap with another span query or which are within x tokens before (controlled by the parameter `pre`) or y tokens after (controlled by the parameter `post`) another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanNotQuery' span_or: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-query description: Matches the union of its span clauses. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanOrQuery' span_term: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-term-query description: Matches spans containing a term. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.SpanTermQuery' minProperties: 1 maxProperties: 1 span_within: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-span-within-query description: Returns matches which are enclosed inside another span query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanWithinQuery' sparse_vector: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-sparse-vector-query description: Using input query vectors or a natural language processing model to convert a query into a list of token-weight pairs, queries against a sparse vector field. x-state: Generally available; Added in 8.15.0 allOf: - $ref: '#/components/schemas/_types.query_dsl.SparseVectorQuery' term: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-term-query description: 'Returns documents that contain an exact term in a provided field. To return a document, the query term must exactly match the queried field''s value, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermQuery' minProperties: 1 maxProperties: 1 terms: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-terms-query description: 'Returns documents that contain one or more exact terms in a provided field. To return a document, one or more terms must exactly match a field value, including whitespace and capitalization.' allOf: - $ref: '#/components/schemas/_types.query_dsl.TermsQuery' terms_set: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-terms-set-query description: 'Returns documents that contain a minimum number of exact terms in a provided field. To return a document, a required number of terms must exactly match the field values, including whitespace and capitalization.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TermsSetQuery' minProperties: 1 maxProperties: 1 text_expansion: deprecated: true externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-text-expansion-query description: Uses a natural language processing model to convert the query text into a list of token-weight pairs which are then used in a query against a sparse vector or rank features field. x-state: Generally available; Added in 8.8.0 type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.TextExpansionQuery' minProperties: 1 maxProperties: 1 weighted_tokens: deprecated: true externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-weighted-tokens-query description: Supports returning text_expansion query results by sending in precomputed tokens with the query. x-state: Generally available; Added in 8.13.0 type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WeightedTokensQuery' minProperties: 1 maxProperties: 1 wildcard: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-wildcard-query description: Returns documents that contain terms matching a wildcard pattern. type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.WildcardQuery' minProperties: 1 maxProperties: 1 wrapper: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-wrapper-query description: A query that accepts any other query as base64 encoded string. allOf: - $ref: '#/components/schemas/_types.query_dsl.WrapperQuery' type: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.TypeQuery' minProperties: 1 maxProperties: 1 _types.aggregations.NestedAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: path: description: The path to the field of type `nested`. allOf: - $ref: '#/components/schemas/_types.Field' _types.SortResults: type: array items: $ref: '#/components/schemas/_types.FieldValue' _types.aggregations.BucketAggregationBase: description: Base type for bucket aggregations. These aggregations also accept sub-aggregations. allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object _global.search._types.HighlighterOrder: type: string enum: - score _types.ExpandWildcards: oneOf: - $ref: '#/components/schemas/_types.ExpandWildcard' - type: array items: $ref: '#/components/schemas/_types.ExpandWildcard' ml._types.JobBlockedReason: type: string enum: - delete - reset - revert _types.analysis.BengaliNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - bengali_normalization required: - type _types.query_dsl.CombinedFieldsOperator: type: string enum: - or - and _types.aggregations.IpRangeAggregationRange: type: object properties: from: description: Start of the range. oneOf: - type: string - type: - string - 'null' mask: description: IP range defined as a CIDR mask. type: string to: description: End of the range. oneOf: - type: string - type: - string - 'null' _types.query_dsl.RankFeatureFunctionLogarithm: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: scaling_factor: description: Configurable scaling factor. type: number required: - scaling_factor _types.analysis.ConditionTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - condition filter: description: Array of token filters. If a token matches the predicate script in the `script` parameter, these filters are applied to the token in the order provided. type: array items: type: string script: description: Predicate script used to apply token filters. If a token matches this script, the filters in the `filter` parameter are applied to the token. allOf: - $ref: '#/components/schemas/_types.Script' required: - type - filter - script _types.analysis.NoriPartOfSpeechTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - nori_part_of_speech stoptags: description: An array of part-of-speech tags that should be removed. type: array items: type: string required: - type ml._types.OverallBucketJob: type: object properties: job_id: allOf: - $ref: '#/components/schemas/_types.Id' max_anomaly_score: type: number required: - job_id - max_anomaly_score _types.aggregations.TermsAggregationExecutionHint: type: string enum: - map - global_ordinals - global_ordinals_hash - global_ordinals_low_cardinality _types.query_dsl.RangeQueryBaseDateMath: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: "Indicates how the range query matches values for `range` fields.\n\nSupported values include:\n - `within`: Matches documents with a range field value entirely within the query’s range.\n - `contains`: Matches documents with a range field value that entirely contains the query’s range.\n - `intersects`: Matches documents with a range field value that intersects the query’s range.\n\n" default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. allOf: - $ref: '#/components/schemas/_types.DateMath' gte: description: Greater than or equal to. allOf: - $ref: '#/components/schemas/_types.DateMath' lt: description: Less than. allOf: - $ref: '#/components/schemas/_types.DateMath' lte: description: Less than or equal to. allOf: - $ref: '#/components/schemas/_types.DateMath' _types.aggregations.BoxplotAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: compression: description: Limits the maximum number of nodes used by the underlying TDigest algorithm to `20 * compression`, enabling control of memory usage and approximation error. type: number execution_hint: description: 'The default implementation of TDigest is optimized for performance, scaling to millions or even billions of sample values while maintaining acceptable accuracy levels (close to 1% relative error for millions of samples in some cases). To use an implementation optimized for accuracy, set this parameter to high_accuracy instead.' default: default allOf: - $ref: '#/components/schemas/_types.aggregations.TDigestExecutionHint' _types.analysis.IcuCollationStrength: type: string enum: - primary - secondary - tertiary - quaternary - identical _types.aggregations.ValueType: type: string enum: - string - long - double - number - date - date_nanos - ip - numeric - geo_point - boolean _global.search._types.BoundaryScanner: type: string enum: - chars - sentence - word _types.query_dsl.PinnedQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-pinned-query allOf: - type: object properties: organic: description: Any choice of query used to rank documents which will be ranked below the "pinned" documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - organic - type: object properties: ids: description: 'Document IDs listed in the order they are to appear in results. Required if `docs` is not specified.' type: array items: $ref: '#/components/schemas/_types.Id' docs: description: 'Documents listed in the order they are to appear in results. Required if `ids` is not specified.' type: array items: $ref: '#/components/schemas/_types.query_dsl.PinnedDoc' minProperties: 1 maxProperties: 1 ml._types.Datafeed: type: object properties: aggregations: type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' authorization: description: The security privileges that the datafeed uses to run its queries. If Elastic Stack security features were disabled at the time of the most recent update to the datafeed, this property is omitted. allOf: - $ref: '#/components/schemas/ml._types.DatafeedAuthorization' chunking_config: allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' datafeed_id: allOf: - $ref: '#/components/schemas/_types.Id' frequency: description: 'The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: `150s`. When `frequency` is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.' allOf: - $ref: '#/components/schemas/_types.Duration' indices: type: array items: type: string indexes: type: array items: type: string job_id: allOf: - $ref: '#/components/schemas/_types.Id' max_empty_searches: type: number query: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: allOf: - $ref: '#/components/schemas/_types.Duration' script_fields: type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: type: number delayed_data_check_config: allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' runtime_mappings: allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' indices_options: allOf: - $ref: '#/components/schemas/_types.IndicesOptions' required: - datafeed_id - indices - job_id - query - delayed_data_check_config _types.aggregations.DateRangeExpression: type: object properties: from: description: Start of the range (inclusive). allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' key: description: Custom key to return the range with. type: string to: description: End of the range (exclusive). allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' _types.aggregations.TermsAggregationCollectMode: type: string enum: - depth_first - breadth_first ml._types.Filter: type: object properties: description: description: A description of the filter. type: string filter_id: description: A string that uniquely identifies a filter. allOf: - $ref: '#/components/schemas/_types.Id' items: description: An array of strings which is the filter item list. type: array items: type: string required: - filter_id - items _types.analysis.IcuCollationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_collation alternate: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationAlternate' caseFirst: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationCaseFirst' caseLevel: type: boolean country: type: string decomposition: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationDecomposition' hiraganaQuaternaryMode: type: boolean language: type: string numeric: type: boolean rules: type: string strength: allOf: - $ref: '#/components/schemas/_types.analysis.IcuCollationStrength' variableTop: type: string variant: type: string required: - type _types.aggregations.BucketCorrelationFunction: type: object properties: count_correlation: description: The configuration to calculate a count correlation. This function is designed for determining the correlation of a term value and a given metric. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunctionCountCorrelation' required: - count_correlation _types.query_dsl.IntervalsAnyOf: type: object properties: intervals: description: An array of rules to match. type: array items: $ref: '#/components/schemas/_types.query_dsl.IntervalsContainer' filter: description: Rule used to filter returned intervals. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - intervals _types.aggregations.BucketSelectorAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script to run for this aggregation. allOf: - $ref: '#/components/schemas/_types.Script' _types.UnitMillis: description: Time unit for milliseconds type: number _types.analysis.DictionaryDecompounderTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CompoundWordTokenFilterBase' - type: object properties: type: type: string enum: - dictionary_decompounder required: - type ml._types.CategorizationAnalyzer: oneOf: - type: string - $ref: '#/components/schemas/ml._types.CategorizationAnalyzerDefinition' _types.ChunkRescorer: type: object properties: size: description: The number of chunks per document to evaluate for reranking. type: number chunking_settings: description: Chunking settings to apply allOf: - $ref: '#/components/schemas/_types.mapping.ChunkRescorerChunkingSettings' _types.analysis.IcuNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_normalizer name: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationType' required: - type - name ml._types.ApiKeyAuthorization: type: object properties: id: description: The identifier for the API key. type: string name: description: The name of the API key. type: string required: - id - name _types.query_dsl.RandomScoreFunction: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' seed: oneOf: - type: number - type: string ml._types.ChunkingMode: type: string enum: - auto - manual - 'off' _types.RRFRetrieverComponent: description: Wraps a retriever with an optional weight for RRF scoring. type: object properties: retriever: description: The nested retriever configuration. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' weight: description: Weight multiplier for this retriever's contribution to the RRF score. Higher values increase influence. Defaults to 1.0 if not specified. Must be non-negative. default: 1.0 type: number required: - retriever _types.query_dsl.PinnedDoc: type: object properties: _id: description: The unique document ID. allOf: - $ref: '#/components/schemas/_types.Id' _index: description: The index that contains the document. allOf: - $ref: '#/components/schemas/_types.IndexName' required: - _id _types.aggregations.DerivativeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object ml._types.RegressionInferenceOptions: type: object properties: results_field: description: The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value. allOf: - $ref: '#/components/schemas/_types.Field' num_top_feature_importance_values: description: Specifies the maximum number of feature importance values per document. default: 0.0 type: number _types.analysis.RussianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - russian_stem required: - type _types.DiversifyRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: type: description: The diversification strategy to apply. allOf: - $ref: '#/components/schemas/_types.DiversifyRetrieverTypes' field: description: The document field on which to diversify results on. type: string retriever: description: The nested retriever whose results will be diversified. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' size: description: The number of top documents to return after diversification. type: number rank_window_size: description: The number of top documents from the nested retriever to consider for diversification. type: number query_vector: description: The query vector used for diversification. allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: a dense vector query vector builder to use instead of a static query_vector allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' lambda: description: Controls the trade-off between relevance and diversity for MMR. A value of 0.0 focuses solely on diversity, while a value of 1.0 focuses solely on relevance. Required for MMR type: number required: - type - field - retriever _types.analysis.LimitTokenCountTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - limit consume_all_tokens: description: If `true`, the limit filter exhausts the token stream, even if the `max_token_count` has already been reached. Defaults to `false`. type: boolean max_token_count: description: Maximum number of tokens to keep. Once this limit is reached, any remaining tokens are excluded from the output. Defaults to `1`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' required: - type _types.query_dsl.RankFeatureFunctionSaturation: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object properties: pivot: description: Configurable pivot value so that the result will be less than 0.5. type: number _global.search._types.HighlighterTagsSchema: type: string enum: - styled _types.query_dsl.DecayFunctionBase: type: object properties: multi_value_mode: description: "Determines how the distance is calculated when a field used for computing the decay contains multiple values.\n\nSupported values include:\n - `min`: Distance is the minimum distance.\n - `max`: Distance is the maximum distance.\n - `avg`: Distance is the average distance.\n - `sum`: Distance is the sum of all distances.\n\n" default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.RuleRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: ruleset_ids: description: The ruleset IDs containing the rules this retriever is evaluating against. oneOf: - $ref: '#/components/schemas/_types.Id' - type: array items: $ref: '#/components/schemas/_types.Id' match_criteria: description: The match criteria that will determine if a rule in the provided rulesets should be applied. type: object retriever: description: The retriever whose results rules should be applied to. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rank_window_size: description: This value determines the size of the individual result set. type: number required: - ruleset_ids - match_criteria - retriever _types.aggregations.Missing: oneOf: - type: string - type: number - type: number - type: boolean _spec_utils.PipeSeparatedFlagsSimpleQueryStringFlag: description: 'A set of flags that can be represented as a single enum value or a set of values that are encoded as a pipe-separated string Depending on the target language, code generators can use this hint to generate language specific flags enum constructs and the corresponding (de-)serialization code.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringFlag' - type: string _types.aggregations.BucketCorrelationFunctionCountCorrelation: type: object properties: indicator: description: The indicator with which to correlate the configured `bucket_path` values. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunctionCountCorrelationIndicator' required: - indicator _types.aggregations.FieldDateMath: description: 'A date range limit, represented either as a DateMath expression or a number expressed according to the target field''s precision.' oneOf: - $ref: '#/components/schemas/_types.DateMath' - type: number _types.analysis.CjkWidthTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - cjk_width required: - type _types.analysis.PatternReplaceCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - pattern_replace flags: type: string pattern: type: string replacement: type: string required: - type - pattern ml._types.JobBlocked: type: object properties: reason: allOf: - $ref: '#/components/schemas/ml._types.JobBlockedReason' task_id: allOf: - $ref: '#/components/schemas/_types.TaskId' required: - reason _types.query_dsl.SpanContainingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: big: description: 'Can be any span query. Matching spans from `big` that contain matches from `little` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' little: description: 'Can be any span query. Matching spans from `big` that contain matches from `little` are returned.' allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - big - little _types.analysis.DelimitedPayloadEncoding: type: string enum: - int - float - identity _spec_utils.Stringifiedinteger: description: 'Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type. Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.' oneOf: - type: number - type: string _types.NodeIds: oneOf: - $ref: '#/components/schemas/_types.NodeId' - type: array items: $ref: '#/components/schemas/_types.NodeId' _types.query_dsl.FuzzyQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: max_expansions: description: Maximum number of variations created. default: 50.0 type: number prefix_length: description: Number of beginning characters left unchanged when creating expansions. default: 0.0 type: number rewrite: description: Number of beginning characters left unchanged when creating expansions. default: constant_score allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' transpositions: description: Indicates whether edits include transpositions of two adjacent characters (for example `ab` to `ba`). default: true type: boolean fuzziness: description: Maximum edit distance allowed for matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' value: description: Term you wish to find in the provided field. oneOf: - type: string - type: number - type: boolean required: - value _global.search._types.RescoreQuery: type: object properties: rescore_query: description: 'The query to use for rescoring. This query is only run on the Top-K results returned by the `query` and `post_filter` phases.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_weight: description: Relative importance of the original query versus the rescore query. default: 1.0 type: number rescore_query_weight: description: Relative importance of the rescore query versus the original query. default: 1.0 type: number score_mode: description: "Determines how scores are combined.\n\nSupported values include:\n - `avg`: Average the original score and the rescore query score.\n - `max`: Take the max of original score and the rescore query score.\n - `min`: Take the min of the original score and the rescore query score.\n - `multiply`: Multiply the original score by the rescore query score.\nUseful for `function` query rescores.\n - `total`: Add the original score and the rescore query score.\n\n" default: total allOf: - $ref: '#/components/schemas/_global.search._types.ScoreMode' required: - rescore_query _types.aggregations.TopMetricsValue: type: object properties: field: description: A field to return as a metric. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.analysis.EdgeNGramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - edge_ngram max_gram: description: Maximum character length of a gram. For custom token filters, defaults to `2`. For the built-in edge_ngram filter, defaults to `1`. type: number min_gram: description: Minimum character length of a gram. Defaults to `1`. type: number side: description: Indicates whether to truncate tokens from the `front` or `back`. Defaults to `front`. allOf: - $ref: '#/components/schemas/_types.analysis.EdgeNGramSide' preserve_original: description: Emits original token when set to `true`. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.aggregations.StringStatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: show_distribution: description: Shows the probability distribution for all characters. default: false type: boolean _types.aggregations.CompositeTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object _types.query_dsl.SpanNearQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: clauses: description: Array of one or more other span type queries. type: array items: $ref: '#/components/schemas/_types.query_dsl.SpanQuery' in_order: description: Controls whether matches are required to be in-order. type: boolean slop: description: Controls the maximum number of intervening unmatched positions permitted. type: number required: - clauses _types.RrfRank: allOf: - $ref: '#/components/schemas/_types.RankBase' - type: object properties: rank_constant: description: How much influence documents in individual result sets per query have over the final ranked result set type: number rank_window_size: description: Size of the individual result sets per query type: number _types.query_dsl.ScriptScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: min_score: description: Documents with a score lower than this floating point number are excluded from the search results. type: number query: description: Query used to return documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' script: description: 'Script used to compute the score of documents returned by the query. Important: final relevance scores from the `script_score` query cannot be negative.' allOf: - $ref: '#/components/schemas/_types.Script' required: - query - script _types.aggregations.GeoLinePoint: type: object properties: field: description: The name of the geo_point field. allOf: - $ref: '#/components/schemas/_types.Field' required: - field _types.analysis.StopWordLanguage: type: string enum: - _arabic_ - _armenian_ - _basque_ - _bengali_ - _brazilian_ - _bulgarian_ - _catalan_ - _cjk_ - _czech_ - _danish_ - _dutch_ - _english_ - _estonian_ - _finnish_ - _french_ - _galician_ - _german_ - _greek_ - _hindi_ - _hungarian_ - _indonesian_ - _irish_ - _italian_ - _latvian_ - _lithuanian_ - _norwegian_ - _persian_ - _portuguese_ - _romanian_ - _russian_ - _serbian_ - _sorani_ - _spanish_ - _swedish_ - _thai_ - _turkish_ - _none_ _types.Name: type: string _types.analysis.ThaiTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - thai required: - type _types.analysis.UppercaseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - uppercase required: - type _types.analysis.SnowballLanguage: type: string enum: - Arabic - Armenian - Basque - Catalan - Danish - Dutch - English - Estonian - Finnish - French - German - German2 - Hungarian - Italian - Irish - Kp - Lithuanian - Lovins - Norwegian - Porter - Portuguese - Romanian - Russian - Serbian - Spanish - Swedish - Turkish ml._types.SnapshotUpgradeState: type: string enum: - loading_old_state - saving_new_state - stopped - failed _types.analysis.NGramTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - ngram custom_token_chars: type: string max_gram: type: number min_gram: type: number token_chars: default: [] type: array items: $ref: '#/components/schemas/_types.analysis.TokenChar' required: - type ml._types.DelayedDataCheckConfig: type: object properties: check_window: description: 'The window of time that is searched for late data. This window of time ends with the latest finalized bucket. It defaults to null, which causes an appropriate `check_window` to be calculated when the real-time datafeed runs. In particular, the default `check_window` span calculation is based on the maximum of `2h` or `8 * bucket_span`.' allOf: - $ref: '#/components/schemas/_types.Duration' enabled: description: Specifies whether the datafeed periodically checks for delayed data. type: boolean required: - enabled _types.aggregations.CompositeAggregationSource: type: object properties: terms: description: A terms aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeTermsAggregation' histogram: description: A histogram aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeHistogramAggregation' date_histogram: description: A date histogram aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeDateHistogramAggregation' geotile_grid: description: A geotile grid aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeGeoTileGridAggregation' minProperties: 1 maxProperties: 1 _types.query_dsl.SpanFirstQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: end: description: Controls the maximum end position permitted in a match. type: number match: description: Can be any other span type query. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - end - match _types.aggregations.RareTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: exclude: description: Terms that should be excluded from the aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' field: description: The field from which to return rare terms. allOf: - $ref: '#/components/schemas/_types.Field' include: description: Terms that should be included in the aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' max_doc_count: description: The maximum number of documents a term should appear in. default: 1.0 type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' precision: description: 'The precision of the internal CuckooFilters. Smaller precision leads to better approximation, but higher memory usage.' default: 0.001 type: number value_type: type: string _types.query_dsl.BoostingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: negative_boost: description: Floating point number between 0 and 1.0 used to decrease the relevance scores of documents matching the `negative` query. type: number negative: description: Query used to decrease the relevance score of matching documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' positive: description: Any returned documents must match this query. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - negative_boost - negative - positive _types.WktGeoBounds: type: object properties: wkt: type: string required: - wkt _types.analysis.KeepTypesMode: type: string enum: - include - exclude _types.aggregations.ScriptedHeuristic: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' required: - script _global.search._types.PointInTimeReference: type: object properties: id: allOf: - $ref: '#/components/schemas/_types.Id' keep_alive: allOf: - $ref: '#/components/schemas/_types.Duration' required: - id _types.CoordsGeoBounds: type: object properties: top: type: number bottom: type: number left: type: number right: type: number required: - top - bottom - left - right _types.aggregations.CumulativeSumAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.query_dsl.WildcardQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: case_insensitive: description: Allows case insensitive matching of the pattern with the indexed field values when set to true. Default is false which means the case sensitivity of matching depends on the underlying field’s mapping. x-state: Generally available; Added in 7.10.0 type: boolean rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Wildcard pattern for terms you wish to find in the provided field. Required, when wildcard is not set. type: string wildcard: description: Wildcard pattern for terms you wish to find in the provided field. Required, when value is not set. type: string _types.query_dsl.TermRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBasestring' - type: object _types.query_dsl.MatchBoolPrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string fuzziness: description: 'Maximum edit distance allowed for matching. Can be applied to the term subqueries constructed for all terms but the final term.' allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_rewrite: description: 'Method used to rewrite the query. Can be applied to the term subqueries constructed for all terms but the final term.' allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: 'If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). Can be applied to the term subqueries constructed for all terms but the final term.' default: true type: boolean max_expansions: description: 'Maximum number of terms to which the query will expand. Can be applied to the term subqueries constructed for all terms but the final term.' default: 50.0 type: number minimum_should_match: description: 'Minimum number of clauses that must match for a document to be returned. Applied to the constructed bool query.' allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' operator: description: 'Boolean logic used to interpret text in the query value. Applied to the constructed bool query.' default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' prefix_length: description: 'Number of beginning characters left unchanged for fuzzy matching. Can be applied to the term subqueries constructed for all terms but the final term.' default: 0.0 type: number query: description: 'Terms you wish to find in the provided field. The last term is used in a prefix query.' type: string required: - query _types.query_dsl.SimpleQueryStringQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert text in the query string into tokens. type: string analyze_wildcard: description: If `true`, the query attempts to analyze wildcard terms in the query string. default: false type: boolean auto_generate_synonyms_phrase_query: description: If `true`, the parser creates a match_phrase query for each multi-position token. default: true type: boolean default_operator: description: Default boolean logic used to interpret text in the query string if no operators are specified. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' fields: description: 'Array of fields you wish to search. Accepts wildcard expressions. You also can boost relevance scores for matches to particular fields using a caret (`^`) notation. Defaults to the `index.query.default_field index` setting, which has a default value of `*`.' type: array items: $ref: '#/components/schemas/_types.Field' flags: description: List of enabled operators for the simple query string syntax. default: ALL allOf: - $ref: '#/components/schemas/_types.query_dsl.SimpleQueryStringFlags' fuzzy_max_expansions: description: Maximum number of terms to which the query expands for fuzzy matching. default: 50.0 type: number fuzzy_prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). type: boolean lenient: description: If `true`, format-based errors, such as providing a text value for a numeric field, are ignored. default: false type: boolean minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' query: description: Query string in the simple query string syntax you wish to parse and use for search. type: string quote_field_suffix: description: Suffix appended to quoted text in the query string. type: string required: - query _types.aggregations.TermsInclude: oneOf: - type: string - type: array items: type: string - $ref: '#/components/schemas/_types.aggregations.TermsPartition' _types.query_dsl.MatchAllQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object _types.UnitFloatMillis: description: Time unit for fractional milliseconds type: number _types.analysis.ElisionTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - elision articles: description: 'List of elisions to remove. To be removed, the elision must be at the beginning of a token and be immediately followed by an apostrophe. Both the elision and apostrophe are removed. For custom `elision` filters, either this parameter or `articles_path` must be specified.' type: array items: type: string articles_path: description: 'Path to a file that contains a list of elisions to remove. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each elision in the file must be separated by a line break. To be removed, the elision must be at the beginning of a token and be immediately followed by an apostrophe. Both the elision and apostrophe are removed. For custom `elision` filters, either this parameter or `articles` must be specified.' type: string articles_case: description: If `true`, elision matching is case insensitive. If `false`, elision matching is case sensitive. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.RankBase: type: object _types.analysis.SerbianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - serbian_normalization required: - type _types.query_dsl.DateDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBaseDateMathDuration' - type: object _types.aggregations.SignificantTermsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: background_filter: description: A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' chi_square: description: Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.ChiSquareHeuristic' exclude: description: Terms to exclude. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: 'Mechanism by which the aggregation should be executed: using field values directly or using global ordinals.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return significant terms. allOf: - $ref: '#/components/schemas/_types.Field' gnd: description: Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.GoogleNormalizedDistanceHeuristic' include: description: Terms to include. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' jlh: description: Use JLH score as the significance score. allOf: - $ref: '#/components/schemas/_types.EmptyObject' min_doc_count: description: Only return terms that are found in more than `min_doc_count` hits. default: 3.0 type: number mutual_information: description: Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.MutualInformationHeuristic' percentage: description: A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentageScoreHeuristic' script_heuristic: description: Customized score, implemented via a script. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedHeuristic' p_value: description: 'Significant terms heuristic that calculates the p-value between the term existing in foreground and background sets. The p-value is the probability of obtaining test results at least as extreme as the results actually observed, under the assumption that the null hypothesis is correct. The p-value is calculated assuming that the foreground set and the background set are independent https://en.wikipedia.org/wiki/Bernoulli_trial, with the null hypothesis that the probabilities are the same.' allOf: - $ref: '#/components/schemas/_types.aggregations.PValueHeuristic' shard_min_doc_count: description: 'Regulates the certainty a shard has if the term should actually be added to the candidate list or not with respect to the `min_doc_count`. Terms will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'Can be used to control the volumes of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number size: description: The number of buckets returned out of the overall terms list. type: number _types.analysis.StemmerOverrideTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stemmer_override rules: description: A list of mapping rules to use. type: array items: type: string rules_path: description: A path (either relative to `config` location, or absolute) to a list of mappings. type: string required: - type _types.analysis.LowercaseTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - lowercase required: - type _types.RescorerRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: Inner retriever. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rescore: oneOf: - $ref: '#/components/schemas/_global.search._types.Rescore' - type: array items: $ref: '#/components/schemas/_global.search._types.Rescore' required: - retriever - rescore _types.aggregations.MaxBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.analysis.LowercaseTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - lowercase language: description: Language-specific lowercase token filter to use. allOf: - $ref: '#/components/schemas/_types.analysis.LowercaseTokenFilterLanguages' required: - type ml._types.PerPartitionCategorization: type: object properties: enabled: description: To enable this setting, you must also set the `partition_field_name` property to the same value in every detector that uses the keyword `mlcategory`. Otherwise, job creation fails. type: boolean stop_on_warn: description: This setting can be set to true only if per-partition categorization is enabled. If true, both categorization and subsequent anomaly detection stops for partitions where the categorization status changes to warn. This setting makes it viable to have a job where it is expected that categorization works well for some partitions but not others; you do not pay the cost of bad categorization forever in the partitions where it works badly. type: boolean _types.aggregations.MissingOrder: type: string enum: - first - last - default _types.AcknowledgedResponseBase: type: object properties: acknowledged: description: For a successful response, this value is always true. On failure, an exception is returned instead. type: boolean required: - acknowledged _types.query_dsl.ParentIdQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: id: description: ID of the parent document. allOf: - $ref: '#/components/schemas/_types.Id' ignore_unmapped: description: Indicates whether to ignore an unmapped `type` and not return any documents instead of an error. default: false type: boolean type: description: Name of the child relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' ml._types.JobStats: type: object properties: assignment_explanation: description: For open anomaly detection jobs only, contains messages relating to the selection of a node to run the job. type: string data_counts: description: 'An object that describes the quantity of input to the job and any related error counts. The `data_count` values are cumulative for the lifetime of a job. If a model snapshot is reverted or old results are deleted, the job counts are not reset.' allOf: - $ref: '#/components/schemas/ml._types.DataCounts' forecasts_stats: description: 'An object that provides statistical information about forecasts belonging to this job. Some statistics are omitted if no forecasts have been made.' allOf: - $ref: '#/components/schemas/ml._types.JobForecastStatistics' job_id: description: Identifier for the anomaly detection job. type: string model_size_stats: description: An object that provides information about the size and contents of the model. allOf: - $ref: '#/components/schemas/ml._types.ModelSizeStats' node: description: 'Contains properties for the node that runs the job. This information is available only for open jobs.' x-state: Generally available allOf: - $ref: '#/components/schemas/ml._types.DiscoveryNodeCompact' open_time: description: For open jobs only, the elapsed time for which the job has been open. allOf: - $ref: '#/components/schemas/_types.DateTime' state: description: "The status of the anomaly detection job, which can be one of the following values: `closed`, `closing`, `failed`, `opened`, `opening`.\n\nSupported values include:\n - `closing`: The job close action is in progress and has not yet completed. A closing job cannot accept further data.\n - `closed`: The job finished successfully with its model state persisted. The job must be opened before it can accept further data.\n - `opened`: The job is available to receive and process data.\n - `failed`: The job did not finish successfully due to an error.\nThis situation can occur due to invalid input data, a fatal error occurring during the analysis, or an external interaction such as the process being killed by the Linux out of memory (OOM) killer.\nIf the job had irrevocably failed, it must be force closed and then deleted.\nIf the datafeed can be corrected, the job can be closed and then re-opened.\n - `opening`: The job open action is in progress and has not yet completed.\n\n" allOf: - $ref: '#/components/schemas/ml._types.JobState' timing_stats: description: An object that provides statistical information about timing aspect of this job. allOf: - $ref: '#/components/schemas/ml._types.JobTimingStats' deleting: description: Indicates that the process of deleting the job is in progress but not yet completed. It is only reported when `true`. type: boolean required: - data_counts - forecasts_stats - job_id - model_size_stats - state - timing_stats _types.query_dsl.ZeroTermsQuery: type: string enum: - all - none _types.aggregations.TermsPartition: type: object properties: num_partitions: description: The number of partitions. type: number partition: description: The partition number for this request. type: number required: - num_partitions - partition ml._types.DataDescription: type: object properties: format: description: Only JSON format is supported at this time. type: string time_field: description: The name of the field that contains the timestamp. default: time allOf: - $ref: '#/components/schemas/_types.Field' time_format: description: 'The time format, which can be `epoch`, `epoch_ms`, or a custom pattern. The value `epoch` refers to UNIX or Epoch time (the number of seconds since 1 Jan 1970). The value `epoch_ms` indicates that time is measured in milliseconds since the epoch. The `epoch` and `epoch_ms` time formats accept either integer or real values. Custom patterns must conform to the Java DateTimeFormatter class. When you use date-time formatting patterns, it is recommended that you provide the full date, time and time zone. For example: `yyyy-MM-dd''T''HH:mm:ssX`. If the pattern that you specify is not sufficient to produce a complete timestamp, job creation fails.' default: epoch type: string field_delimiter: type: string _types.Sort: oneOf: - $ref: '#/components/schemas/_types.SortCombinations' - type: array items: $ref: '#/components/schemas/_types.SortCombinations' _types.aggregations.NormalizeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: method: description: "The specific method to apply.\n\nSupported values include:\n - `rescale_0_1`: This method rescales the data such that the minimum number is 0, and the maximum number is 1, with the rest normalized linearly in-between.\n - `rescale_0_100`: This method rescales the data such that the minimum number is 0, and the maximum number is 100, with the rest normalized linearly in-between.\n - `percent_of_sum`: This method normalizes each value so that it represents a percentage of the total sum it attributes to.\n - `mean`: This method normalizes such that each value is normalized by how much it differs from the average.\n - `z-score`: This method normalizes such that each value represents how far it is from the mean relative to the standard deviation.\n - `softmax`: This method normalizes such that each value is exponentiated and relative to the sum of the exponents of the original values.\n\n" allOf: - $ref: '#/components/schemas/_types.aggregations.NormalizeMethod' _types.aggregations.FrequentItemSetsAggregation: type: object properties: fields: description: Fields to analyze. type: array items: $ref: '#/components/schemas/_types.aggregations.FrequentItemSetsField' minimum_set_size: description: The minimum size of one item set. default: 1.0 type: number minimum_support: description: The minimum support of one item set. default: 0.1 type: number size: description: The number of top item sets to return. default: 10.0 type: number filter: description: Query that filters documents from analysis. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - fields _types.query_dsl.TermsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object _types.analysis.CharFilterBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.analysis.IcuNormalizationType: type: string enum: - nfc - nfkc - nfkc_cf ml._types.ClassificationInferenceOptions: type: object properties: num_top_classes: description: Specifies the number of top class predictions to return. Defaults to 0. type: number num_top_feature_importance_values: description: Specifies the maximum number of feature importance values per document. default: 0.0 type: number prediction_field_type: description: 'Specifies the type of the predicted field to write. Acceptable values are: string, number, boolean. When boolean is provided 1.0 is transformed to true and 0.0 to false.' type: string results_field: description: The field that is added to incoming documents to contain the inference prediction. Defaults to predicted_value. type: string top_classes_results_field: description: Specifies the field to which the top classes are written. Defaults to top_classes. type: string _types.aggregations.MissingAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The name of the field. allOf: - $ref: '#/components/schemas/_types.Field' missing: allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' _types.analysis.SimplePatternSplitTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - simple_pattern_split pattern: type: string required: - type _types.analysis.ArabicNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - arabic_normalization required: - type _types.query_dsl.FunctionBoostMode: type: string enum: - multiply - replace - sum - avg - max - min ml._types.MemoryStatus: type: string enum: - ok - soft_limit - hard_limit _types.aggregations.CustomCategorizeTextAnalyzer: type: object properties: char_filter: type: array items: type: string tokenizer: type: string filter: type: array items: type: string _types.TaskId: type: string _types.query_dsl.LikeDocument: type: object properties: doc: description: A document not present in the index. type: object fields: type: array items: $ref: '#/components/schemas/_types.Field' _id: description: ID of a document. allOf: - $ref: '#/components/schemas/_types.Id' _index: description: Index of a document. allOf: - $ref: '#/components/schemas/_types.IndexName' per_field_analyzer: description: Overrides the default analyzer. type: object additionalProperties: type: string routing: allOf: - $ref: '#/components/schemas/_types.Routing' version: allOf: - $ref: '#/components/schemas/_types.VersionNumber' version_type: description: "\n\nSupported values include:\n - `internal`: Use internal versioning that starts at 1 and increments with each update or delete.\n - `external`: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document.\n - `external_gte`: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document.\nNOTE: The `external_gte` version type is meant for special use cases and should be used with care.\nIf used incorrectly, it can result in loss of data.\n\n" default: '''internal''' allOf: - $ref: '#/components/schemas/_types.VersionType' _types.TextSimilarityReranker: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retriever: description: The nested retriever which will produce the first-level results, that will later be used for reranking. allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' rank_window_size: description: This value determines how many documents we will consider from the nested retriever. type: number inference_id: description: Unique identifier of the inference endpoint created using the inference API. type: string inference_text: description: The text snippet used as the basis for similarity comparison. type: string field: description: The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text. type: string chunk_rescorer: description: Whether to rescore on only the best matching chunks. x-state: Generally available; Added in 9.2.0 allOf: - $ref: '#/components/schemas/_types.ChunkRescorer' required: - retriever - inference_text - field _types.analysis.PathHierarchyTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - path_hierarchy buffer_size: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' delimiter: type: string replacement: type: string reverse: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' skip: allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedinteger' required: - type _types.aggregations.SignificantTextAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: background_filter: description: A background filter that can be used to focus in on significant terms within a narrower context, instead of the entire index. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' chi_square: description: Use Chi square, as described in "Information Retrieval", Manning et al., Chapter 13.5.2, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.ChiSquareHeuristic' exclude: description: Values to exclude. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' execution_hint: description: Determines whether the aggregation will use field values directly or global ordinals. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregationExecutionHint' field: description: The field from which to return significant text. allOf: - $ref: '#/components/schemas/_types.Field' filter_duplicate_text: description: Whether to out duplicate text to deal with noisy data. type: boolean gnd: description: Use Google normalized distance as described in "The Google Similarity Distance", Cilibrasi and Vitanyi, 2007, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.GoogleNormalizedDistanceHeuristic' include: description: Values to include. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' jlh: description: Use JLH score as the significance score. allOf: - $ref: '#/components/schemas/_types.EmptyObject' min_doc_count: description: Only return values that are found in more than `min_doc_count` hits. default: 3.0 type: number mutual_information: description: Use mutual information as described in "Information Retrieval", Manning et al., Chapter 13.5.1, as the significance score. allOf: - $ref: '#/components/schemas/_types.aggregations.MutualInformationHeuristic' percentage: description: A simple calculation of the number of documents in the foreground sample with a term divided by the number of documents in the background with the term. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentageScoreHeuristic' script_heuristic: description: Customized score, implemented via a script. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedHeuristic' shard_min_doc_count: description: 'Regulates the certainty a shard has if the values should actually be added to the candidate list or not with respect to the min_doc_count. Values will only be considered if their local shard frequency within the set is higher than the `shard_min_doc_count`.' type: number shard_size: description: 'The number of candidate terms produced by each shard. By default, `shard_size` will be automatically estimated based on the number of shards and the `size` parameter.' type: number size: description: The number of buckets returned out of the overall terms list. type: number source_fields: description: Overrides the JSON `_source` fields from which text will be analyzed. allOf: - $ref: '#/components/schemas/_types.Fields' _types.query_dsl.DistanceFeatureQueryBaseDateMathDuration: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' allOf: - $ref: '#/components/schemas/_types.DateMath' pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' allOf: - $ref: '#/components/schemas/_types.Duration' field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field _types.aggregations.CompositeAggregateKey: type: object additionalProperties: $ref: '#/components/schemas/_types.FieldValue' _types.analysis.EdgeNGramSide: type: string enum: - front - back _types.ByteSize: oneOf: - type: number - type: string _types.query_dsl.FieldAndFormat: description: A reference to a field with formatting instructions on how to return the value type: object properties: field: description: A wildcard pattern. The request returns values for field names matching this pattern. allOf: - $ref: '#/components/schemas/_types.Field' format: description: The format in which the values are returned. type: string include_unmapped: type: boolean required: - field _types.query_dsl.MatchNoneQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object ml._types.OverallBucket: type: object properties: bucket_span: description: The length of the bucket in seconds. Matches the job with the longest bucket_span value. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitSeconds' is_interim: description: If true, this is an interim result. In other words, the results are calculated based on partial input data. type: boolean jobs: description: An array of objects that contain the max_anomaly_score per job_id. type: array items: $ref: '#/components/schemas/ml._types.OverallBucketJob' overall_score: description: The top_n average of the maximum bucket anomaly_score per job. type: number result_type: description: Internal. This is always set to overall_bucket. type: string timestamp: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' timestamp_string: description: The start time of the bucket for which these results were calculated. allOf: - $ref: '#/components/schemas/_types.DateTime' required: - bucket_span - is_interim - jobs - overall_score - result_type - timestamp _types.aggregations.StatsBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.query_dsl.DistanceFeatureQueryBase: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: origin: description: 'Date or point of origin used to calculate distances. If the `field` value is a `date` or `date_nanos` field, the `origin` value must be a date. Date Math, such as `now-1h`, is supported. If the field value is a `geo_point` field, the `origin` value must be a geopoint.' type: object pivot: description: 'Distance from the `origin` at which relevance scores receive half of the `boost` value. If the `field` value is a `date` or `date_nanos` field, the `pivot` value must be a time unit, such as `1h` or `10d`. If the `field` value is a `geo_point` field, the `pivot` value must be a distance unit, such as `1km` or `12m`.' type: object field: description: 'Name of the field used to calculate distances. This field must meet the following criteria: be a `date`, `date_nanos` or `geo_point` field; have an `index` mapping parameter value of `true`, which is the default; have an `doc_values` mapping parameter value of `true`, which is the default.' allOf: - $ref: '#/components/schemas/_types.Field' required: - origin - pivot - field _types.aggregations.RateAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: unit: description: 'The interval used to calculate the rate. By default, the interval of the `date_histogram` is used.' allOf: - $ref: '#/components/schemas/_types.aggregations.CalendarInterval' mode: description: "How the rate is calculated.\n\nSupported values include:\n - `sum`: Calculates the sum of all values of the field.\n - `value_count`: Uses the number of values of the field.\n\n" default: sum allOf: - $ref: '#/components/schemas/_types.aggregations.RateMode' _types.aggregations.RateMode: type: string enum: - sum - value_count _types.query_dsl.DecayFunction: oneOf: - $ref: '#/components/schemas/_types.query_dsl.UntypedDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.DateDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.NumericDecayFunction' - $ref: '#/components/schemas/_types.query_dsl.GeoDecayFunction' _types.analysis.JaStopTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - ja_stop stopwords: allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' required: - type _types.aggregations.AggregationContainer: allOf: - type: object properties: aggregations: description: 'Sub-aggregations for this aggregation. Only applies to bucket aggregations.' type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' meta: allOf: - $ref: '#/components/schemas/_types.Metadata' - type: object properties: adjacency_matrix: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-adjacency-matrix-aggregation description: 'A bucket aggregation returning a form of adjacency matrix. The request provides a collection of named filter expressions, similar to the `filters` aggregation. Each bucket in the response represents a non-empty cell in the matrix of intersecting filters.' allOf: - $ref: '#/components/schemas/_types.aggregations.AdjacencyMatrixAggregation' auto_date_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-autodatehistogram-aggregation description: A multi-bucket aggregation similar to the date histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided. allOf: - $ref: '#/components/schemas/_types.aggregations.AutoDateHistogramAggregation' avg: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-avg-aggregation description: A single-value metrics aggregation that computes the average of numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.AverageAggregation' avg_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-avg-bucket-aggregation description: 'A sibling pipeline aggregation which calculates the mean value of a specified metric in a sibling aggregation. The specified metric must be numeric and the sibling aggregation must be a multi-bucket aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.AverageBucketAggregation' boxplot: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-boxplot-aggregation description: A metrics aggregation that computes a box plot of numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.BoxplotAggregation' bucket_script: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-script-aggregation description: A parent pipeline aggregation which runs a script which can perform per bucket computations on metrics in the parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketScriptAggregation' bucket_selector: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-selector-aggregation description: A parent pipeline aggregation which runs a script to determine whether the current bucket will be retained in the parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketSelectorAggregation' bucket_sort: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-bucket-sort-aggregation description: A parent pipeline aggregation which sorts the buckets of its parent multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketSortAggregation' bucket_count_ks_test: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-count-ks-test-aggregation description: A sibling pipeline aggregation which runs a two sample Kolmogorov–Smirnov test ("K-S test") against a provided distribution and the distribution implied by the documents counts in the configured sibling aggregation. x-state: Technical preview allOf: - $ref: '#/components/schemas/_types.aggregations.BucketKsAggregation' bucket_correlation: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-correlation-aggregation description: A sibling pipeline aggregation which runs a correlation function on the configured sibling multi-bucket aggregation. x-state: Technical preview allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationAggregation' cardinality: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cardinality-aggregation description: A single-value metrics aggregation that calculates an approximate count of distinct values. allOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityAggregation' cartesian_bounds: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cartesian-bounds-aggregation description: A metric aggregation that computes the spatial bounding box containing all values for a Point or Shape field. allOf: - $ref: '#/components/schemas/_types.aggregations.CartesianBoundsAggregation' cartesian_centroid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-cartesian-centroid-aggregation description: A metric aggregation that computes the weighted centroid from all coordinate values for point and shape fields. allOf: - $ref: '#/components/schemas/_types.aggregations.CartesianCentroidAggregation' categorize_text: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-categorize-text-aggregation description: A multi-bucket aggregation that groups semi-structured text into buckets. x-state: Technical preview allOf: - $ref: '#/components/schemas/_types.aggregations.CategorizeTextAggregation' change_point: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-change-point-aggregation description: 'A sibling pipeline that detects, spikes, dips, and change points in a metric. Given a distribution of values provided by the sibling multi-bucket aggregation, this aggregation indicates the bucket of any spike or dip and/or the bucket at which the largest change in the distribution of values, if they are statistically significant. There must be at least 22 bucketed values. Fewer than 1,000 is preferred.' allOf: - $ref: '#/components/schemas/_types.aggregations.ChangePointAggregation' children: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-children-aggregation description: A single bucket aggregation that selects child documents that have the specified type, as defined in a `join` field. allOf: - $ref: '#/components/schemas/_types.aggregations.ChildrenAggregation' composite: description: 'A multi-bucket aggregation that creates composite buckets from different sources. Unlike the other multi-bucket aggregations, you can use the `composite` aggregation to paginate *all* buckets from a multi-level aggregation efficiently.' allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregation' cumulative_cardinality: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-cumulative-cardinality-aggregation description: A parent pipeline aggregation which calculates the cumulative cardinality in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CumulativeCardinalityAggregation' cumulative_sum: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-cumulative-sum-aggregation description: A parent pipeline aggregation which calculates the cumulative sum of a specified metric in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.CumulativeSumAggregation' date_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-datehistogram-aggregation description: 'A multi-bucket values source based aggregation that can be applied on date values or date range values extracted from the documents. It dynamically builds fixed size (interval) buckets over the values.' allOf: - $ref: '#/components/schemas/_types.aggregations.DateHistogramAggregation' date_range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-daterange-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of date ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.DateRangeAggregation' derivative: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-derivative-aggregation description: A parent pipeline aggregation which calculates the derivative of a specified metric in a parent `histogram` or `date_histogram` aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.DerivativeAggregation' diversified_sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-diversified-sampler-aggregation description: 'A filtering aggregation used to limit any sub aggregations'' processing to a sample of the top-scoring documents. Similar to the `sampler` aggregation, but adds the ability to limit the number of matches that share a common value.' allOf: - $ref: '#/components/schemas/_types.aggregations.DiversifiedSamplerAggregation' extended_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-extendedstats-aggregation description: A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedStatsAggregation' extended_stats_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-extended-stats-bucket-aggregation description: A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedStatsBucketAggregation' frequent_item_sets: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-frequent-item-sets-aggregation description: A bucket aggregation which finds frequent item sets, a form of association rules mining that identifies items that often occur together. allOf: - $ref: '#/components/schemas/_types.aggregations.FrequentItemSetsAggregation' filter: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-filter-aggregation description: A single bucket aggregation that narrows the set of documents to those that match a query. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' filters: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-filters-aggregation description: A multi-bucket aggregation where each bucket contains the documents that match a query. allOf: - $ref: '#/components/schemas/_types.aggregations.FiltersAggregation' geo_bounds: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geobounds-aggregation description: A metric aggregation that computes the geographic bounding box containing all values for a Geopoint or Geoshape field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoBoundsAggregation' geo_centroid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geocentroid-aggregation description: A metric aggregation that computes the weighted centroid from all coordinate values for geo fields. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoCentroidAggregation' geo_distance: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geodistance-aggregation description: 'A multi-bucket aggregation that works on `geo_point` fields. Evaluates the distance of each document value from an origin point and determines the buckets it belongs to, based on ranges defined in the request.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoDistanceAggregation' geohash_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geohashgrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell is labeled using a geohash which is of user-definable precision.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoHashGridAggregation' geo_line: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-geo-line description: Aggregates all `geo_point` values within a bucket into a `LineString` ordered by the chosen sort field. allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineAggregation' geotile_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geotilegrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell corresponds to a map tile as used by many online map sites.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeoTileGridAggregation' geohex_grid: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-geohexgrid-aggregation description: 'A multi-bucket aggregation that groups `geo_point` and `geo_shape` values into buckets that represent a grid. Each cell corresponds to a H3 cell index and is labeled using the H3Index representation.' allOf: - $ref: '#/components/schemas/_types.aggregations.GeohexGridAggregation' global: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-global-aggregation description: 'Defines a single bucket of all the documents within the search execution context. This context is defined by the indices and the document types you’re searching on, but is not influenced by the search query itself.' allOf: - $ref: '#/components/schemas/_types.aggregations.GlobalAggregation' histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-histogram-aggregation description: 'A multi-bucket values source based aggregation that can be applied on numeric values or numeric range values extracted from the documents. It dynamically builds fixed size (interval) buckets over the values.' allOf: - $ref: '#/components/schemas/_types.aggregations.HistogramAggregation' ip_range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-iprange-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of IP ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.IpRangeAggregation' ip_prefix: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-ipprefix-aggregation description: A bucket aggregation that groups documents based on the network or sub-network of an IP address. allOf: - $ref: '#/components/schemas/_types.aggregations.IpPrefixAggregation' inference: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-inference-bucket-aggregation description: A parent pipeline aggregation which loads a pre-trained model and performs inference on the collated result fields from the parent bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.InferenceAggregation' line: allOf: - $ref: '#/components/schemas/_types.aggregations.GeoLineAggregation' matrix_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-matrix-stats-aggregation description: 'A numeric aggregation that computes the following statistics over a set of document fields: `count`, `mean`, `variance`, `skewness`, `kurtosis`, `covariance`, and `covariance`.' allOf: - $ref: '#/components/schemas/_types.aggregations.MatrixStatsAggregation' max: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-max-aggregation description: A single-value metrics aggregation that returns the maximum value among the numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.MaxAggregation' max_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-max-bucket-aggregation description: A sibling pipeline aggregation which identifies the bucket(s) with the maximum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s). allOf: - $ref: '#/components/schemas/_types.aggregations.MaxBucketAggregation' median_absolute_deviation: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-median-absolute-deviation-aggregation description: A single-value aggregation that approximates the median absolute deviation of its search results. allOf: - $ref: '#/components/schemas/_types.aggregations.MedianAbsoluteDeviationAggregation' min: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-min-aggregation description: A single-value metrics aggregation that returns the minimum value among numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.MinAggregation' min_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-min-bucket-aggregation description: A sibling pipeline aggregation which identifies the bucket(s) with the minimum value of a specified metric in a sibling aggregation and outputs both the value and the key(s) of the bucket(s). allOf: - $ref: '#/components/schemas/_types.aggregations.MinBucketAggregation' missing: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-missing-aggregation description: A field data based single bucket aggregation, that creates a bucket of all documents in the current document set context that are missing a field value (effectively, missing a field or having the configured NULL value set). allOf: - $ref: '#/components/schemas/_types.aggregations.MissingAggregation' moving_avg: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregation' moving_percentiles: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-moving-percentiles-aggregation description: Given an ordered series of percentiles, "slides" a window across those percentiles and computes cumulative percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.MovingPercentilesAggregation' moving_fn: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-movfn-aggregation description: 'Given an ordered series of data, "slides" a window across the data and runs a custom script on each window of data. For convenience, a number of common functions are predefined such as `min`, `max`, and moving averages.' allOf: - $ref: '#/components/schemas/_types.aggregations.MovingFunctionAggregation' multi_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-multi-terms-aggregation description: A multi-bucket value source based aggregation where buckets are dynamically built - one per unique set of values. allOf: - $ref: '#/components/schemas/_types.aggregations.MultiTermsAggregation' nested: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-nested-aggregation description: A special single bucket aggregation that enables aggregating nested documents. allOf: - $ref: '#/components/schemas/_types.aggregations.NestedAggregation' normalize: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-normalize-aggregation description: A parent pipeline aggregation which calculates the specific normalized/rescaled value for a specific bucket value. allOf: - $ref: '#/components/schemas/_types.aggregations.NormalizeAggregation' parent: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-parent-aggregation description: A special single bucket aggregation that selects parent documents that have the specified type, as defined in a `join` field. allOf: - $ref: '#/components/schemas/_types.aggregations.ParentAggregation' percentile_ranks: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-percentile-rank-aggregation description: A multi-value metrics aggregation that calculates one or more percentile ranks over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentileRanksAggregation' percentiles: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-percentile-aggregation description: A multi-value metrics aggregation that calculates one or more percentiles over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentilesAggregation' percentiles_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-percentiles-bucket-aggregation description: A sibling pipeline aggregation which calculates percentiles across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.PercentilesBucketAggregation' range: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-range-aggregation description: A multi-bucket value source based aggregation that enables the user to define a set of ranges - each representing a bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.RangeAggregation' rare_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-rare-terms-aggregation description: A multi-bucket value source based aggregation which finds "rare" terms — terms that are at the long-tail of the distribution and are not frequent. allOf: - $ref: '#/components/schemas/_types.aggregations.RareTermsAggregation' rate: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-rate-aggregation description: 'Calculates a rate of documents or a field in each bucket. Can only be used inside a `date_histogram` or `composite` aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.RateAggregation' reverse_nested: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-reverse-nested-aggregation description: 'A special single bucket aggregation that enables aggregating on parent documents from nested documents. Should only be defined inside a `nested` aggregation.' allOf: - $ref: '#/components/schemas/_types.aggregations.ReverseNestedAggregation' random_sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-random-sampler-aggregation description: 'A single bucket aggregation that randomly includes documents in the aggregated results. Sampling provides significant speed improvement at the cost of accuracy.' x-state: Technical preview; Added in 8.1.0 allOf: - $ref: '#/components/schemas/_types.aggregations.RandomSamplerAggregation' sampler: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-sampler-aggregation description: A filtering aggregation used to limit any sub aggregations' processing to a sample of the top-scoring documents. allOf: - $ref: '#/components/schemas/_types.aggregations.SamplerAggregation' scripted_metric: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-scripted-metric-aggregation description: A metric aggregation that uses scripts to provide a metric output. allOf: - $ref: '#/components/schemas/_types.aggregations.ScriptedMetricAggregation' serial_diff: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-serialdiff-aggregation description: An aggregation that subtracts values in a time series from themselves at different time lags or periods. allOf: - $ref: '#/components/schemas/_types.aggregations.SerialDifferencingAggregation' significant_terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-significantterms-aggregation description: Returns interesting or unusual occurrences of terms in a set. allOf: - $ref: '#/components/schemas/_types.aggregations.SignificantTermsAggregation' significant_text: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-significanttext-aggregation description: Returns interesting or unusual occurrences of free-text terms in a set. allOf: - $ref: '#/components/schemas/_types.aggregations.SignificantTextAggregation' stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-stats-aggregation description: A multi-value metrics aggregation that computes stats over numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.StatsAggregation' stats_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-stats-bucket-aggregation description: A sibling pipeline aggregation which calculates a variety of stats across all bucket of a specified metric in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.StatsBucketAggregation' string_stats: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-string-stats-aggregation description: A multi-value metrics aggregation that computes statistics over string values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.StringStatsAggregation' sum: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-sum-aggregation description: A single-value metrics aggregation that sums numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.SumAggregation' sum_bucket: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-pipeline-sum-bucket-aggregation description: A sibling pipeline aggregation which calculates the sum of a specified metric across all buckets in a sibling aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.SumBucketAggregation' terms: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-terms-aggregation description: A multi-bucket value source based aggregation where buckets are dynamically built - one per unique value. allOf: - $ref: '#/components/schemas/_types.aggregations.TermsAggregation' time_series: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-time-series-aggregation description: 'The time series aggregation queries data created using a time series index. This is typically data such as metrics or other data streams with a time component, and requires creating an index using the time series mode.' x-state: Technical preview allOf: - $ref: '#/components/schemas/_types.aggregations.TimeSeriesAggregation' top_hits: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-top-hits-aggregation description: A metric aggregation that returns the top matching documents per bucket. allOf: - $ref: '#/components/schemas/_types.aggregations.TopHitsAggregation' t_test: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-ttest-aggregation description: A metrics aggregation that performs a statistical hypothesis test in which the test statistic follows a Student’s t-distribution under the null hypothesis on numeric values extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.TTestAggregation' top_metrics: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-top-metrics description: A metric aggregation that selects metrics from the document with the largest or smallest sort value. allOf: - $ref: '#/components/schemas/_types.aggregations.TopMetricsAggregation' value_count: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-valuecount-aggregation description: A single-value metrics aggregation that counts the number of values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.ValueCountAggregation' weighted_avg: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-metrics-weight-avg-aggregation description: A single-value metrics aggregation that computes the weighted average of numeric values that are extracted from the aggregated documents. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageAggregation' variable_width_histogram: externalDocs: url: https://www.elastic.co/docs/reference/aggregations/search-aggregations-bucket-variablewidthhistogram-aggregation description: A multi-bucket aggregation similar to the histogram, except instead of providing an interval to use as the width of each bucket, a target number of buckets is provided. allOf: - $ref: '#/components/schemas/_types.aggregations.VariableWidthHistogramAggregation' minProperties: 1 maxProperties: 1 _global.search._types.InnerHits: type: object properties: name: description: 'The name for the particular inner hit definition in the response. Useful when a search request contains multiple inner hits.' allOf: - $ref: '#/components/schemas/_types.Name' size: description: The maximum number of hits to return per `inner_hits`. default: 3.0 type: number from: description: Inner hit starting document offset. default: 0.0 type: number collapse: allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' docvalue_fields: type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' explain: type: boolean highlight: allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' ignore_unmapped: type: boolean script_fields: type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' seq_no_primary_term: type: boolean fields: type: array items: $ref: '#/components/schemas/_types.Field' sort: description: 'How the inner hits should be sorted per `inner_hits`. By default, inner hits are sorted by score.' allOf: - $ref: '#/components/schemas/_types.Sort' _source: allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' stored_fields: allOf: - $ref: '#/components/schemas/_types.Fields' track_scores: default: false type: boolean version: type: boolean _types.query_dsl.RangeQueryBasestring: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: "Indicates how the range query matches values for `range` fields.\n\nSupported values include:\n - `within`: Matches documents with a range field value entirely within the query’s range.\n - `contains`: Matches documents with a range field value that entirely contains the query’s range.\n - `intersects`: Matches documents with a range field value that intersects the query’s range.\n\n" default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: string gte: description: Greater than or equal to. type: string lt: description: Less than. type: string lte: description: Less than or equal to. type: string _types.query_dsl.IdsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: values: description: An array of document IDs. allOf: - $ref: '#/components/schemas/_types.Ids' _types.analysis.ScandinavianNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - scandinavian_normalization required: - type _types.aggregations.TestPopulation: type: object properties: field: description: The field to aggregate. allOf: - $ref: '#/components/schemas/_types.Field' script: allOf: - $ref: '#/components/schemas/_types.Script' filter: description: A filter used to define a set of records to run unpaired t-test on. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - field _types.RetrieverContainer: type: object properties: standard: description: A retriever that replaces the functionality of a traditional query. allOf: - $ref: '#/components/schemas/_types.StandardRetriever' knn: description: A retriever that replaces the functionality of a knn search. allOf: - $ref: '#/components/schemas/_types.KnnRetriever' rrf: description: A retriever that produces top documents from reciprocal rank fusion (RRF). allOf: - $ref: '#/components/schemas/_types.RRFRetriever' text_similarity_reranker: description: A retriever that reranks the top documents based on a reranking model using the InferenceAPI allOf: - $ref: '#/components/schemas/_types.TextSimilarityReranker' rule: description: A retriever that replaces the functionality of a rule query. allOf: - $ref: '#/components/schemas/_types.RuleRetriever' rescorer: description: A retriever that re-scores only the results produced by its child retriever. allOf: - $ref: '#/components/schemas/_types.RescorerRetriever' linear: description: A retriever that supports the combination of different retrievers through a weighted linear combination. allOf: - $ref: '#/components/schemas/_types.LinearRetriever' pinned: description: 'A pinned retriever applies pinned documents to the underlying retriever. This retriever will rewrite to a PinnedQueryBuilder.' allOf: - $ref: '#/components/schemas/_types.PinnedRetriever' diversify: description: A retriever that diversifies the results from its child retriever. allOf: - $ref: '#/components/schemas/_types.DiversifyRetriever' minProperties: 1 maxProperties: 1 _types.query_dsl.UntypedDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBase' - type: object ml._types.DatafeedStats: type: object properties: assignment_explanation: description: For started datafeeds only, contains messages relating to the selection of a node. type: string datafeed_id: description: 'A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' allOf: - $ref: '#/components/schemas/_types.Id' node: description: For started datafeeds only, this information pertains to the node upon which the datafeed is started. x-state: Generally available allOf: - $ref: '#/components/schemas/ml._types.DiscoveryNodeCompact' state: description: 'The status of the datafeed, which can be one of the following values: `starting`, `started`, `stopping`, `stopped`.' allOf: - $ref: '#/components/schemas/ml._types.DatafeedState' timing_stats: description: An object that provides statistical information about timing aspect of this datafeed. allOf: - $ref: '#/components/schemas/ml._types.DatafeedTimingStats' running_state: description: 'An object containing the running state for this datafeed. It is only provided if the datafeed is started.' allOf: - $ref: '#/components/schemas/ml._types.DatafeedRunningState' required: - datafeed_id - state _types.query_dsl.TypeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: type: string required: - value ml._types.Category: type: object properties: category_id: description: A unique identifier for the category. category_id is unique at the job level, even when per-partition categorization is enabled. allOf: - $ref: '#/components/schemas/_types.ulong' examples: description: A list of examples of actual values that matched the category. type: array items: type: string grok_pattern: description: '[experimental] A Grok pattern that could be used in Logstash or an ingest pipeline to extract fields from messages that match the category. This field is experimental and may be changed or removed in a future release. The Grok patterns that are found are not optimal, but are often a good starting point for manual tweaking.' allOf: - $ref: '#/components/schemas/_types.GrokPattern' job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' max_matching_length: description: The maximum length of the fields that matched the category. The value is increased by 10% to enable matching for similar fields that have not been analyzed. allOf: - $ref: '#/components/schemas/_types.ulong' partition_field_name: description: If per-partition categorization is enabled, this property identifies the field used to segment the categorization. It is not present when per-partition categorization is disabled. type: string partition_field_value: description: If per-partition categorization is enabled, this property identifies the value of the partition_field_name for the category. It is not present when per-partition categorization is disabled. type: string regex: description: A regular expression that is used to search for values that match the category. type: string terms: description: A space separated list of the common tokens that are matched in values of the category. type: string num_matches: description: The number of messages that have been matched by this category. This is only guaranteed to have the latest accurate count after a job _flush or _close type: number preferred_to_categories: description: A list of category_id entries that this current category encompasses. Any new message that is processed by the categorizer will match against this category and not any of the categories in this list. This is only guaranteed to have the latest accurate list of categories after a job _flush or _close type: array items: $ref: '#/components/schemas/_types.Id' p: type: string result_type: type: string mlcategory: type: string required: - category_id - examples - job_id - max_matching_length - regex - terms - result_type - mlcategory _types.ScriptSource: oneOf: - type: string - $ref: '#/components/schemas/_global.search._types.SearchRequestBody' _types.aggregations.HoltMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - holt settings: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltLinearModelSettings' required: - model - settings ml._types.RuleAction: type: string enum: - skip_result - skip_model_update _types.analysis.TokenChar: type: string enum: - letter - digit - whitespace - punctuation - symbol - custom _global.search._types.SourceFilter: type: object properties: exclude_vectors: description: 'If `true`, vector fields are excluded from the returned source. This option takes precedence over `includes`: any vector field will remain excluded even if it matches an `includes` rule.' type: boolean excludes: description: A list of fields to exclude from the returned source. allOf: - $ref: '#/components/schemas/_types.Fields' includes: description: A list of fields to include in the returned source. allOf: - $ref: '#/components/schemas/_types.Fields' _types.RRFRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: retrievers: description: A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter. type: array items: $ref: '#/components/schemas/_types.RRFRetrieverEntry' rank_constant: description: This value determines how much influence documents in individual result sets per query have over the final ranked result set. type: number rank_window_size: description: This value determines the size of the individual result sets per query. type: number query: type: string fields: type: array items: type: string required: - retrievers _types.aggregations.MaxAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.query_dsl.GeoBoundingBoxQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: type: deprecated: true allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoExecution' validation_method: description: "Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude.\nSet to `COERCE` to also try to infer correct latitude or longitude.\n\nSupported values include:\n - `coerce`: Accept geo points with invalid latitude or longitude and additionally try and infer correct coordinates.\n - `ignore_malformed`: Accept geo points with invalid latitude or longitude.\n - `strict`\n\n" default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean _types.VersionNumber: type: number _types.mapping.ChunkRescorerChunkingSettings: type: object properties: strategy: externalDocs: url: https://www.elastic.co/docs/explore-analyze/elastic-inference/inference-api#chunking-strategies description: "The chunking strategy: `sentence`, `word`, `none` or `recursive`.\n\n * If `strategy` is set to `recursive`, you must also specify:\n\n- `max_chunk_size`\n- either `separators` or`separator_group`\n\nLearn more about different chunking strategies in the linked documentation." default: sentence type: string separator_group: description: 'Only applicable to the `recursive` strategy and required when using it. Sets a predefined list of separators in the saved chunking settings based on the selected text type. Values can be `markdown` or `plaintext`. Using this parameter is an alternative to manually specifying a custom `separators` list.' type: string separators: description: 'Only applicable to the `recursive` strategy and required when using it. A list of strings used as possible split points when chunking text. Each string can be a plain string or a regular expression (regex) pattern. The system tries each separator in order to split the text, starting from the first item in the list. After splitting, it attempts to recombine smaller pieces into larger chunks that stay within the `max_chunk_size` limit, to reduce the total number of chunks generated.' type: array items: type: string max_chunk_size: description: 'The maximum size of a chunk in words. This value cannot be lower than `20` (for `sentence` strategy) or `10` (for `word` strategy). This value should not exceed the window size for the associated model.' default: 250.0 type: number overlap: description: 'The number of overlapping words for chunks. It is applicable only to a `word` chunking strategy. This value cannot be higher than half the `max_chunk_size` value.' default: 100.0 type: number sentence_overlap: description: 'The number of overlapping sentences for chunks. It is applicable only for a `sentence` chunking strategy. It can be either `1` or `0`.' default: 1.0 type: number required: - max_chunk_size _types.RankContainer: type: object properties: rrf: description: The reciprocal rank fusion parameters allOf: - $ref: '#/components/schemas/_types.RrfRank' minProperties: 1 maxProperties: 1 _types.query_dsl.GeoGridQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: geotile: allOf: - $ref: '#/components/schemas/_types.GeoTile' geohash: allOf: - $ref: '#/components/schemas/_types.GeoHash' geohex: allOf: - $ref: '#/components/schemas/_types.GeoHexCell' minProperties: 1 maxProperties: 1 _types.Id: type: string _types.analysis.CharGroupTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - char_group tokenize_on_chars: type: array items: type: string max_token_length: type: number required: - type - tokenize_on_chars ml._types.DiscoveryNodeCompact: description: Alternative representation of DiscoveryNode used in ml.get_job_stats and ml.get_datafeed_stats type: object properties: name: allOf: - $ref: '#/components/schemas/_types.Name' ephemeral_id: allOf: - $ref: '#/components/schemas/_types.Id' id: allOf: - $ref: '#/components/schemas/_types.Id' transport_address: allOf: - $ref: '#/components/schemas/_types.TransportAddress' attributes: type: object additionalProperties: type: string required: - name - ephemeral_id - id - transport_address - attributes _types.query_dsl.NestedQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: Indicates whether to ignore an unmapped path and not return any documents instead of an error. default: false type: boolean inner_hits: description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' path: description: Path to the nested object you wish to search. allOf: - $ref: '#/components/schemas/_types.Field' query: description: Query you wish to run on nested objects in the path. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: How scores for matching child objects affect the root parent document’s relevance score. default: '''avg''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ChildScoreMode' required: - path - query _types.DiversifyRetrieverTypes: type: string enum: - mmr _types.analysis.LengthTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - length max: description: Maximum character length of a token. Longer tokens are excluded from the output. Defaults to `Integer.MAX_VALUE`, which is `2^31-1` or `2147483647`. type: number min: description: Minimum character length of a token. Shorter tokens are excluded from the output. Defaults to `0`. type: number required: - type _types.analysis.StandardTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - standard max_token_length: type: number required: - type _types.analysis.IcuTransformDirection: type: string enum: - forward - reverse _global.search._types.HighlightBase: type: object properties: type: description: "\n\nSupported values include:\n - `plain`: The `plain` highlighter uses the standard Lucene highlighter\n - `fvh`: The fvh highlighter uses the Lucene Fast Vector highlighter.\n - `unified`: The unified highlighter uses the Lucene Unified Highlighter.\n\n" allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterType' boundary_chars: description: A string that contains each boundary character. default: .,!? \t\n type: string boundary_max_scan: description: How far to scan for boundary characters. default: 20.0 type: number boundary_scanner: description: "Specifies how to break the highlighted fragments: chars, sentence, or word.\nOnly valid for the unified and fvh highlighters.\nDefaults to `sentence` for the `unified` highlighter. Defaults to `chars` for the `fvh` highlighter.\n\nSupported values include:\n - `chars`: Use the characters specified by `boundary_chars` as highlighting boundaries.\nThe `boundary_max_scan` setting controls how far to scan for boundary characters.\nOnly valid for the `fvh` highlighter.\n - `sentence`: Break highlighted fragments at the next sentence boundary, as determined by Java’s `BreakIterator`.\nYou can specify the locale to use with `boundary_scanner_locale`.\nWhen used with the `unified` highlighter, the `sentence` scanner splits sentences bigger than `fragment_size` at the first word boundary next to fragment_size.\nYou can set `fragment_size` to `0` to never split any sentence.\n - `word`: Break highlighted fragments at the next word boundary, as determined by Java’s `BreakIterator`.\nYou can specify the locale to use with `boundary_scanner_locale`.\n\n" allOf: - $ref: '#/components/schemas/_global.search._types.BoundaryScanner' boundary_scanner_locale: description: 'Controls which locale is used to search for sentence and word boundaries. This parameter takes a form of a language tag, for example: `"en-US"`, `"fr-FR"`, `"ja-JP"`.' default: Locale.ROOT type: string force_source: deprecated: true type: boolean fragmenter: description: 'Specifies how text should be broken up in highlight snippets: `simple` or `span`. Only valid for the `plain` highlighter.' default: span allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterFragmenter' fragment_size: description: The size of the highlighted fragment in characters. default: 100.0 type: number highlight_filter: type: boolean highlight_query: description: 'Highlight matches for a query other than the search query. This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' max_fragment_length: type: number max_analyzed_offset: description: 'If set to a non-negative value, highlighting stops at this defined maximum limit. The rest of the text is not processed, thus not highlighted and no error is returned The `max_analyzed_offset` query setting does not override the `index.highlight.max_analyzed_offset` setting, which prevails when it’s set to lower value than the query setting.' type: number no_match_size: description: The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight. default: 0.0 type: number number_of_fragments: description: 'The maximum number of fragments to return. If the number of fragments is set to `0`, no fragments are returned. Instead, the entire field contents are highlighted and returned. This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required. If `number_of_fragments` is `0`, `fragment_size` is ignored.' default: 5.0 type: number options: type: object additionalProperties: type: object order: description: 'Sorts highlighted fragments by score when set to `score`. By default, fragments will be output in the order they appear in the field (order: `none`). Setting this option to `score` will output the most relevant fragments first. Each highlighter applies its own logic to compute relevancy scores.' default: none allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterOrder' phrase_limit: description: 'Controls the number of matching phrases in a document that are considered. Prevents the `fvh` highlighter from analyzing too many phrases and consuming too much memory. When using `matched_fields`, `phrase_limit` phrases per matched field are considered. Raising the limit increases query time and consumes more memory. Only supported by the `fvh` highlighter.' default: 256.0 type: number post_tags: description: 'Use in conjunction with `pre_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags.' type: array items: type: string pre_tags: description: 'Use in conjunction with `post_tags` to define the HTML tags to use for the highlighted text. By default, highlighted text is wrapped in `` and `` tags.' type: array items: type: string require_field_match: description: 'By default, only fields that contains a query match are highlighted. Set to `false` to highlight all fields.' default: true type: boolean tags_schema: description: Set to `styled` to use the built-in tag schema. allOf: - $ref: '#/components/schemas/_global.search._types.HighlighterTagsSchema' ml._types.BucketSummary: type: object properties: anomaly_score: description: 'The maximum anomaly score, between 0-100, for any of the bucket influencers. This is an overall, rate-limited score for the job. All the anomaly records in the bucket contribute to this score. This value might be updated as new data is analyzed.' type: number bucket_influencers: type: array items: $ref: '#/components/schemas/ml._types.BucketInfluencer' bucket_span: description: The length of the bucket in seconds. This value matches the bucket span that is specified in the job. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitSeconds' event_count: description: The number of input data records processed in this bucket. type: number initial_anomaly_score: description: 'The maximum anomaly score for any of the bucket influencers. This is the initial value that was calculated at the time the bucket was processed.' type: number is_interim: description: If true, this is an interim result. In other words, the results are calculated based on partial input data. type: boolean job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' processing_time_ms: description: The amount of time, in milliseconds, that it took to analyze the bucket contents and calculate results. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitMillis' result_type: description: Internal. This value is always set to bucket. type: string timestamp: description: 'The start time of the bucket. This timestamp uniquely identifies the bucket. Events that occur exactly at the timestamp of the bucket are included in the results for the bucket.' allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' timestamp_string: description: 'The start time of the bucket. This timestamp uniquely identifies the bucket. Events that occur exactly at the timestamp of the bucket are included in the results for the bucket.' allOf: - $ref: '#/components/schemas/_types.DateTime' required: - anomaly_score - bucket_influencers - bucket_span - event_count - initial_anomaly_score - is_interim - job_id - processing_time_ms - result_type - timestamp _types.aggregations.MovingAverageAggregation: discriminator: propertyName: model mapping: ewma: '#/components/schemas/_types.aggregations.EwmaMovingAverageAggregation' holt: '#/components/schemas/_types.aggregations.HoltMovingAverageAggregation' holt_winters: '#/components/schemas/_types.aggregations.HoltWintersMovingAverageAggregation' linear: '#/components/schemas/_types.aggregations.LinearMovingAverageAggregation' simple: '#/components/schemas/_types.aggregations.SimpleMovingAverageAggregation' oneOf: - $ref: '#/components/schemas/_types.aggregations.LinearMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.SimpleMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.EwmaMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.HoltMovingAverageAggregation' - $ref: '#/components/schemas/_types.aggregations.HoltWintersMovingAverageAggregation' _types.StandardRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: query: description: Defines a query to retrieve a set of top documents. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' search_after: description: Defines a search after object parameter used for pagination. allOf: - $ref: '#/components/schemas/_types.SortResults' terminate_after: description: Maximum number of documents to collect for each shard. type: number sort: description: A sort object that that specifies the order of matching documents. allOf: - $ref: '#/components/schemas/_types.Sort' collapse: description: Collapses the top documents by a specified key into a single top document per key. allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' ml._types.DatafeedAuthorization: type: object properties: api_key: description: If an API key was used for the most recent update to the datafeed, its name and identifier are listed in the response. allOf: - $ref: '#/components/schemas/ml._types.ApiKeyAuthorization' roles: description: If a user ID was used for the most recent update to the datafeed, its roles at the time of the update are listed in the response. type: array items: type: string service_account: description: If a service account was used for the most recent update to the datafeed, the account name is listed in the response. type: string ml._types.JobConfig: type: object properties: allow_lazy_open: description: Advanced configuration option. Specifies whether this job can open when there is insufficient machine learning node capacity for it to be immediately assigned to a node. default: false type: boolean analysis_config: description: 'The analysis configuration, which specifies how to analyze the data. After you create a job, you cannot change the analysis configuration; all the properties are informational.' allOf: - $ref: '#/components/schemas/ml._types.AnalysisConfig' analysis_limits: description: 'Limits can be applied for the resources required to hold the mathematical models in memory. These limits are approximate and can be set per job. They do not control the memory used by other processes, for example the Elasticsearch Java processes.' allOf: - $ref: '#/components/schemas/ml._types.AnalysisLimits' background_persist_interval: description: 'Advanced configuration option. The time between each periodic persistence of the model. The default value is a randomized value between 3 to 4 hours, which avoids all jobs persisting at exactly the same time. The smallest allowed value is 1 hour.' allOf: - $ref: '#/components/schemas/_types.Duration' custom_settings: description: 'Advanced configuration option. Contains custom metadata about the job.' allOf: - $ref: '#/components/schemas/ml._types.CustomSettings' daily_model_snapshot_retention_after_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies a period of time (in days) after which only the first snapshot per day is retained. This period is relative to the timestamp of the most recent snapshot for this job.' default: 1.0 type: number data_description: description: 'The data description defines the format of the input data when you send data to the job by using the post data API. Note that when configure a datafeed, these properties are automatically set.' allOf: - $ref: '#/components/schemas/ml._types.DataDescription' datafeed_config: description: 'The datafeed, which retrieves data from Elasticsearch for analysis by the job. You can associate only one datafeed with each anomaly detection job.' allOf: - $ref: '#/components/schemas/ml._types.DatafeedConfig' description: description: A description of the job. type: string groups: description: A list of job groups. A job can belong to no groups or many. type: array items: type: string job_id: description: 'Identifier for the anomaly detection job. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.' allOf: - $ref: '#/components/schemas/_types.Id' model_plot_config: description: 'This advanced configuration option stores model information along with the results. It provides a more detailed view into anomaly detection. Model plot provides a simplified and indicative view of the model and its bounds.' allOf: - $ref: '#/components/schemas/ml._types.ModelPlotConfig' model_snapshot_retention_days: description: 'Advanced configuration option, which affects the automatic removal of old model snapshots for this job. It specifies the maximum period of time (in days) that snapshots are retained. This period is relative to the timestamp of the most recent snapshot for this job. The default value is `10`, which means snapshots ten days older than the newest snapshot are deleted.' default: 10.0 type: number renormalization_window_days: description: 'Advanced configuration option. The period over which adjustments to the score are applied, as new data is seen. The default value is the longer of 30 days or 100 `bucket_spans`.' type: number results_index_name: description: 'A text string that affects the name of the machine learning results index. The default value is `shared`, which generates an index named `.ml-anomalies-shared`.' default: shared allOf: - $ref: '#/components/schemas/_types.IndexName' results_retention_days: description: 'Advanced configuration option. The period of time (in days) that results are retained. Age is calculated relative to the timestamp of the latest bucket result. If this property has a non-null value, once per day at 00:30 (server time), results that are the specified number of days older than the latest bucket result are deleted from Elasticsearch. The default value is null, which means all results are retained. Annotations generated by the system also count as results for retention purposes; they are deleted after the same number of days as results. Annotations added by users are retained forever.' type: number required: - analysis_config - data_description _types.analysis.CjkBigramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - cjk_bigram ignored_scripts: description: Array of character scripts for which to disable bigrams. type: array items: $ref: '#/components/schemas/_types.analysis.CjkBigramIgnoredScript' output_unigrams: description: If `true`, emit tokens in both bigram and unigram form. If `false`, a CJK character is output in unigram form when it has no adjacent characters. Defaults to `false`. type: boolean required: - type ml._types.JobTimingStats: type: object properties: average_bucket_processing_time_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' bucket_count: type: number exponential_average_bucket_processing_time_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' exponential_average_bucket_processing_time_per_hour_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' job_id: allOf: - $ref: '#/components/schemas/_types.Id' total_bucket_processing_time_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' maximum_bucket_processing_time_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' minimum_bucket_processing_time_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' required: - bucket_count - exponential_average_bucket_processing_time_per_hour_ms - job_id - total_bucket_processing_time_ms _types.RetrieverBase: type: object properties: filter: description: Query to filter the documents that can match. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' min_score: description: Minimum _score for matching documents. Documents with a lower _score are not included in the top documents. type: number _name: description: Retriever name. type: string _types.query_dsl.UntypedDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBase' - type: object _types.aggregations.BucketPathAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: buckets_path: description: Path to the buckets that contain one set of values to correlate. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsPath' _types.query_dsl.TextExpansionQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: model_id: description: The text expansion NLP model to use type: string model_text: description: The query text type: string pruning_config: description: Token pruning configurations x-state: Technical preview; Added in 8.13.0 allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - model_id - model_text _types.analysis.KStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kstem required: - type _types.aggregations.EwmaModelSettings: type: object properties: alpha: type: number _types.KnnRetriever: allOf: - $ref: '#/components/schemas/_types.RetrieverBase' - type: object properties: field: description: The name of the vector field to search against. type: string query_vector: description: Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: Defines a model to build a query vector. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' k: description: Number of nearest neighbors to return as top hits. type: number num_candidates: description: Number of nearest neighbor candidates to consider per shard. type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number similarity: description: The minimum similarity required for a document to be considered a match. type: number rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' required: - field - k - num_candidates _types.analysis.KeywordRepeatTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keyword_repeat required: - type _types.VersionString: type: string _types.aggregations.MultiTermLookup: type: object properties: field: description: A fields from which to retrieve terms. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' required: - field ml._types.DatafeedConfig: type: object properties: aggregations: description: If set, the datafeed performs aggregation searches. Support for aggregations is limited and should be used only with low cardinality data. type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' chunking_config: description: Datafeeds might be required to search over long time periods, for several months or years. This search is split into time chunks in order to ensure the load on Elasticsearch is managed. Chunking configuration controls how the size of these time chunks are calculated and is an advanced configuration option. allOf: - $ref: '#/components/schemas/ml._types.ChunkingConfig' datafeed_id: description: A numerical character string that uniquely identifies the datafeed. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters. The default value is the job identifier. allOf: - $ref: '#/components/schemas/_types.Id' delayed_data_check_config: description: Specifies whether the datafeed checks for missing data and the size of the window. The datafeed can optionally search over indices that have already been read in an effort to determine whether any data has subsequently been added to the index. If missing data is found, it is a good indication that the `query_delay` option is set too low and the data is being indexed after the datafeed has passed that moment in time. This check runs only on real-time datafeeds. allOf: - $ref: '#/components/schemas/ml._types.DelayedDataCheckConfig' frequency: description: 'The interval at which scheduled queries are made while the datafeed runs in real time. The default value is either the bucket span for short bucket spans, or, for longer bucket spans, a sensible fraction of the bucket span. For example: `150s`. When `frequency` is shorter than the bucket span, interim results for the last (partial) bucket are written then eventually overwritten by the full bucket results. If the datafeed uses aggregations, this value must be divisible by the interval of the date histogram aggregation.' allOf: - $ref: '#/components/schemas/_types.Duration' indices: description: An array of index names. Wildcards are supported. If any indices are in remote clusters, the machine learning nodes must have the `remote_cluster_client` role. allOf: - $ref: '#/components/schemas/_types.Indices' indices_options: description: Specifies index expansion options that are used during search. allOf: - $ref: '#/components/schemas/_types.IndicesOptions' job_id: allOf: - $ref: '#/components/schemas/_types.Id' max_empty_searches: description: If a real-time datafeed has never seen any data (including during any initial training period) then it will automatically stop itself and close its associated job after this many real-time searches that return no documents. In other words, it will stop after `frequency` times `max_empty_searches` of real-time operation. If not set then a datafeed with no end time that sees no data will remain started until it is explicitly stopped. type: number query: description: The Elasticsearch query domain-specific language (DSL). This value corresponds to the query object in an Elasticsearch search POST body. All the options that are supported by Elasticsearch can be used, as this object is passed verbatim to Elasticsearch. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' query_delay: description: The number of seconds behind real time that data is queried. For example, if data from 10:04 a.m. might not be searchable in Elasticsearch until 10:06 a.m., set this property to 120 seconds. The default value is randomly selected between `60s` and `120s`. This randomness improves the query performance when there are multiple jobs running on the same node. allOf: - $ref: '#/components/schemas/_types.Duration' runtime_mappings: description: Specifies runtime fields for the datafeed search. allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' script_fields: description: Specifies scripts that evaluate custom expressions and returns script fields to the datafeed. The detector configuration objects in a job can contain functions that use these script fields. type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' scroll_size: description: The size parameter that is used in Elasticsearch searches when the datafeed does not use aggregations. The maximum value is the value of `index.max_result_window`, which is 10,000 by default. default: 1000.0 type: number _types.ScriptSortType: type: string enum: - string - number - version _types.query_dsl.RangeQueryBase: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: relation: description: "Indicates how the range query matches values for `range` fields.\n\nSupported values include:\n - `within`: Matches documents with a range field value entirely within the query’s range.\n - `contains`: Matches documents with a range field value that entirely contains the query’s range.\n - `intersects`: Matches documents with a range field value that intersects the query’s range.\n\n" default: intersects allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeRelation' gt: description: Greater than. type: object gte: description: Greater than or equal to. type: object lt: description: Less than. type: object lte: description: Less than or equal to. type: object _types.analysis.TokenFilterDefinition: discriminator: propertyName: type mapping: apostrophe: '#/components/schemas/_types.analysis.ApostropheTokenFilter' arabic_normalization: '#/components/schemas/_types.analysis.ArabicNormalizationTokenFilter' arabic_stem: '#/components/schemas/_types.analysis.ArabicStemTokenFilter' asciifolding: '#/components/schemas/_types.analysis.AsciiFoldingTokenFilter' bengali_normalization: '#/components/schemas/_types.analysis.BengaliNormalizationTokenFilter' brazilian_stem: '#/components/schemas/_types.analysis.BrazilianStemTokenFilter' cjk_bigram: '#/components/schemas/_types.analysis.CjkBigramTokenFilter' cjk_width: '#/components/schemas/_types.analysis.CjkWidthTokenFilter' classic: '#/components/schemas/_types.analysis.ClassicTokenFilter' common_grams: '#/components/schemas/_types.analysis.CommonGramsTokenFilter' condition: '#/components/schemas/_types.analysis.ConditionTokenFilter' czech_stem: '#/components/schemas/_types.analysis.CzechStemTokenFilter' decimal_digit: '#/components/schemas/_types.analysis.DecimalDigitTokenFilter' delimited_payload: '#/components/schemas/_types.analysis.DelimitedPayloadTokenFilter' dictionary_decompounder: '#/components/schemas/_types.analysis.DictionaryDecompounderTokenFilter' dutch_stem: '#/components/schemas/_types.analysis.DutchStemTokenFilter' edge_ngram: '#/components/schemas/_types.analysis.EdgeNGramTokenFilter' elision: '#/components/schemas/_types.analysis.ElisionTokenFilter' fingerprint: '#/components/schemas/_types.analysis.FingerprintTokenFilter' flatten_graph: '#/components/schemas/_types.analysis.FlattenGraphTokenFilter' french_stem: '#/components/schemas/_types.analysis.FrenchStemTokenFilter' german_normalization: '#/components/schemas/_types.analysis.GermanNormalizationTokenFilter' german_stem: '#/components/schemas/_types.analysis.GermanStemTokenFilter' hindi_normalization: '#/components/schemas/_types.analysis.HindiNormalizationTokenFilter' hunspell: '#/components/schemas/_types.analysis.HunspellTokenFilter' hyphenation_decompounder: '#/components/schemas/_types.analysis.HyphenationDecompounderTokenFilter' icu_collation: '#/components/schemas/_types.analysis.IcuCollationTokenFilter' icu_folding: '#/components/schemas/_types.analysis.IcuFoldingTokenFilter' icu_normalizer: '#/components/schemas/_types.analysis.IcuNormalizationTokenFilter' icu_transform: '#/components/schemas/_types.analysis.IcuTransformTokenFilter' indic_normalization: '#/components/schemas/_types.analysis.IndicNormalizationTokenFilter' ja_stop: '#/components/schemas/_types.analysis.JaStopTokenFilter' keep: '#/components/schemas/_types.analysis.KeepWordsTokenFilter' keep_types: '#/components/schemas/_types.analysis.KeepTypesTokenFilter' keyword_marker: '#/components/schemas/_types.analysis.KeywordMarkerTokenFilter' keyword_repeat: '#/components/schemas/_types.analysis.KeywordRepeatTokenFilter' kstem: '#/components/schemas/_types.analysis.KStemTokenFilter' kuromoji_part_of_speech: '#/components/schemas/_types.analysis.KuromojiPartOfSpeechTokenFilter' kuromoji_readingform: '#/components/schemas/_types.analysis.KuromojiReadingFormTokenFilter' kuromoji_stemmer: '#/components/schemas/_types.analysis.KuromojiStemmerTokenFilter' length: '#/components/schemas/_types.analysis.LengthTokenFilter' limit: '#/components/schemas/_types.analysis.LimitTokenCountTokenFilter' lowercase: '#/components/schemas/_types.analysis.LowercaseTokenFilter' min_hash: '#/components/schemas/_types.analysis.MinHashTokenFilter' multiplexer: '#/components/schemas/_types.analysis.MultiplexerTokenFilter' ngram: '#/components/schemas/_types.analysis.NGramTokenFilter' nori_part_of_speech: '#/components/schemas/_types.analysis.NoriPartOfSpeechTokenFilter' pattern_capture: '#/components/schemas/_types.analysis.PatternCaptureTokenFilter' pattern_replace: '#/components/schemas/_types.analysis.PatternReplaceTokenFilter' persian_normalization: '#/components/schemas/_types.analysis.PersianNormalizationTokenFilter' persian_stem: '#/components/schemas/_types.analysis.PersianStemTokenFilter' phonetic: '#/components/schemas/_types.analysis.PhoneticTokenFilter' porter_stem: '#/components/schemas/_types.analysis.PorterStemTokenFilter' predicate_token_filter: '#/components/schemas/_types.analysis.PredicateTokenFilter' remove_duplicates: '#/components/schemas/_types.analysis.RemoveDuplicatesTokenFilter' reverse: '#/components/schemas/_types.analysis.ReverseTokenFilter' russian_stem: '#/components/schemas/_types.analysis.RussianStemTokenFilter' scandinavian_folding: '#/components/schemas/_types.analysis.ScandinavianFoldingTokenFilter' scandinavian_normalization: '#/components/schemas/_types.analysis.ScandinavianNormalizationTokenFilter' serbian_normalization: '#/components/schemas/_types.analysis.SerbianNormalizationTokenFilter' shingle: '#/components/schemas/_types.analysis.ShingleTokenFilter' snowball: '#/components/schemas/_types.analysis.SnowballTokenFilter' sorani_normalization: '#/components/schemas/_types.analysis.SoraniNormalizationTokenFilter' stemmer: '#/components/schemas/_types.analysis.StemmerTokenFilter' stemmer_override: '#/components/schemas/_types.analysis.StemmerOverrideTokenFilter' stop: '#/components/schemas/_types.analysis.StopTokenFilter' synonym: '#/components/schemas/_types.analysis.SynonymTokenFilter' synonym_graph: '#/components/schemas/_types.analysis.SynonymGraphTokenFilter' trim: '#/components/schemas/_types.analysis.TrimTokenFilter' truncate: '#/components/schemas/_types.analysis.TruncateTokenFilter' unique: '#/components/schemas/_types.analysis.UniqueTokenFilter' uppercase: '#/components/schemas/_types.analysis.UppercaseTokenFilter' word_delimiter: '#/components/schemas/_types.analysis.WordDelimiterTokenFilter' word_delimiter_graph: '#/components/schemas/_types.analysis.WordDelimiterGraphTokenFilter' oneOf: - $ref: '#/components/schemas/_types.analysis.ApostropheTokenFilter' - $ref: '#/components/schemas/_types.analysis.ArabicStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.ArabicNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.AsciiFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.BengaliNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.BrazilianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.CjkBigramTokenFilter' - $ref: '#/components/schemas/_types.analysis.CjkWidthTokenFilter' - $ref: '#/components/schemas/_types.analysis.ClassicTokenFilter' - $ref: '#/components/schemas/_types.analysis.CommonGramsTokenFilter' - $ref: '#/components/schemas/_types.analysis.ConditionTokenFilter' - $ref: '#/components/schemas/_types.analysis.CzechStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.DecimalDigitTokenFilter' - $ref: '#/components/schemas/_types.analysis.DelimitedPayloadTokenFilter' - $ref: '#/components/schemas/_types.analysis.DutchStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.EdgeNGramTokenFilter' - $ref: '#/components/schemas/_types.analysis.ElisionTokenFilter' - $ref: '#/components/schemas/_types.analysis.FingerprintTokenFilter' - $ref: '#/components/schemas/_types.analysis.FlattenGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.FrenchStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.GermanNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.GermanStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.HindiNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.HunspellTokenFilter' - $ref: '#/components/schemas/_types.analysis.HyphenationDecompounderTokenFilter' - $ref: '#/components/schemas/_types.analysis.IndicNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeepTypesTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeepWordsTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeywordMarkerTokenFilter' - $ref: '#/components/schemas/_types.analysis.KeywordRepeatTokenFilter' - $ref: '#/components/schemas/_types.analysis.KStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.LengthTokenFilter' - $ref: '#/components/schemas/_types.analysis.LimitTokenCountTokenFilter' - $ref: '#/components/schemas/_types.analysis.LowercaseTokenFilter' - $ref: '#/components/schemas/_types.analysis.MinHashTokenFilter' - $ref: '#/components/schemas/_types.analysis.MultiplexerTokenFilter' - $ref: '#/components/schemas/_types.analysis.NGramTokenFilter' - $ref: '#/components/schemas/_types.analysis.NoriPartOfSpeechTokenFilter' - $ref: '#/components/schemas/_types.analysis.PatternCaptureTokenFilter' - $ref: '#/components/schemas/_types.analysis.PatternReplaceTokenFilter' - $ref: '#/components/schemas/_types.analysis.PersianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.PersianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.PorterStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.PredicateTokenFilter' - $ref: '#/components/schemas/_types.analysis.RemoveDuplicatesTokenFilter' - $ref: '#/components/schemas/_types.analysis.ReverseTokenFilter' - $ref: '#/components/schemas/_types.analysis.RussianStemTokenFilter' - $ref: '#/components/schemas/_types.analysis.ScandinavianFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.ScandinavianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.SerbianNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.ShingleTokenFilter' - $ref: '#/components/schemas/_types.analysis.SnowballTokenFilter' - $ref: '#/components/schemas/_types.analysis.SoraniNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.StemmerOverrideTokenFilter' - $ref: '#/components/schemas/_types.analysis.StemmerTokenFilter' - $ref: '#/components/schemas/_types.analysis.StopTokenFilter' - $ref: '#/components/schemas/_types.analysis.SynonymGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.SynonymTokenFilter' - $ref: '#/components/schemas/_types.analysis.TrimTokenFilter' - $ref: '#/components/schemas/_types.analysis.TruncateTokenFilter' - $ref: '#/components/schemas/_types.analysis.UniqueTokenFilter' - $ref: '#/components/schemas/_types.analysis.UppercaseTokenFilter' - $ref: '#/components/schemas/_types.analysis.WordDelimiterGraphTokenFilter' - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilter' - $ref: '#/components/schemas/_types.analysis.JaStopTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiStemmerTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiReadingFormTokenFilter' - $ref: '#/components/schemas/_types.analysis.KuromojiPartOfSpeechTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuCollationTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuFoldingTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuNormalizationTokenFilter' - $ref: '#/components/schemas/_types.analysis.IcuTransformTokenFilter' - $ref: '#/components/schemas/_types.analysis.PhoneticTokenFilter' - $ref: '#/components/schemas/_types.analysis.DictionaryDecompounderTokenFilter' _types.aggregations.SimpleMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - simple settings: allOf: - $ref: '#/components/schemas/_types.EmptyObject' required: - model - settings _types.query_dsl.SpanFieldMaskingQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' query: allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' required: - field - query ml._types.AnalysisConfigRead: type: object properties: bucket_span: description: The size of the interval that the analysis is aggregated into, typically between `5m` and `1h`. default: 5m allOf: - $ref: '#/components/schemas/_types.Duration' categorization_analyzer: description: 'If `categorization_field_name` is specified, you can also define the analyzer that is used to interpret the categorization field. This property cannot be used at the same time as `categorization_filters`. The categorization analyzer specifies how the `categorization_field` is interpreted by the categorization process.' allOf: - $ref: '#/components/schemas/ml._types.CategorizationAnalyzer' categorization_field_name: description: 'If this property is specified, the values of the specified field will be categorized. The resulting categories must be used in a detector by setting `by_field_name`, `over_field_name`, or `partition_field_name` to the keyword `mlcategory`.' allOf: - $ref: '#/components/schemas/_types.Field' categorization_filters: description: 'If `categorization_field_name` is specified, you can also define optional filters. This property expects an array of regular expressions. The expressions are used to filter out matching sequences from the categorization field values.' type: array items: type: string detectors: description: 'An array of detector configuration objects. Detector configuration objects specify which data fields a job analyzes. They also specify which analytical functions are used. You can specify multiple detectors for a job.' type: array items: $ref: '#/components/schemas/ml._types.DetectorRead' influencers: description: 'A comma separated list of influencer field names. Typically these can be the by, over, or partition fields that are used in the detector configuration. You might also want to use a field name that is not specifically named in a detector, but is available as part of the input data. When you use multiple detectors, the use of influencers is recommended as it aggregates results for each influencer entity.' type: array items: $ref: '#/components/schemas/_types.Field' model_prune_window: description: 'Advanced configuration option. Affects the pruning of models that have not been updated for the given time duration. The value must be set to a multiple of the `bucket_span`. If set too low, important information may be removed from the model. Typically, set to `30d` or longer. If not set, model pruning only occurs if the model memory status reaches the soft limit or the hard limit. For jobs created in 8.1 and later, the default value is the greater of `30d` or 20 times `bucket_span`.' allOf: - $ref: '#/components/schemas/_types.Duration' latency: description: 'The size of the window in which to expect data that is out of time order. Defaults to no latency. If you specify a non-zero value, it must be greater than or equal to one second.' default: '0' allOf: - $ref: '#/components/schemas/_types.Duration' multivariate_by_fields: description: 'This functionality is reserved for internal use. It is not supported for use in customer environments and is not subject to the support SLA of official GA features. If set to `true`, the analysis will automatically find correlations between metrics for a given by field value and report anomalies when those correlations cease to hold.' type: boolean per_partition_categorization: description: Settings related to how categorization interacts with partition fields. allOf: - $ref: '#/components/schemas/ml._types.PerPartitionCategorization' summary_count_field_name: description: 'If this property is specified, the data that is fed to the job is expected to be pre-summarized. This property value is the name of the field that contains the count of raw data points that have been summarized. The same `summary_count_field_name` applies to all detectors in the job.' allOf: - $ref: '#/components/schemas/_types.Field' required: - bucket_span - detectors - influencers _types.aggregations.AggregateOrder: oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.SortOrder' minProperties: 1 maxProperties: 1 - type: array items: type: object additionalProperties: $ref: '#/components/schemas/_types.SortOrder' minProperties: 1 maxProperties: 1 _types.aggregations.WeightedAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: format: description: A numeric response formatter. type: string value: description: Configuration for the field that provides the values. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageValue' value_type: allOf: - $ref: '#/components/schemas/_types.aggregations.ValueType' weight: description: Configuration for the field or script that provides the weights. allOf: - $ref: '#/components/schemas/_types.aggregations.WeightedAverageValue' _types.analysis.StopTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stop ignore_case: description: If `true`, stop word matching is case insensitive. For example, if `true`, a stop word of the matches and removes `The`, `THE`, or `the`. Defaults to `false`. type: boolean remove_trailing: description: If `true`, the last token of a stream is removed if it’s a stop word. Defaults to `true`. type: boolean stopwords: description: Language value, such as `_arabic_` or `_thai_`. Defaults to `_english_`. allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' stopwords_path: description: 'Path to a file that contains a list of stop words to remove. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each stop word in the file must be separated by a line break.' type: string required: - type _types.CategoryId: type: number _types.aggregations.EwmaMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - ewma settings: allOf: - $ref: '#/components/schemas/_types.aggregations.EwmaModelSettings' required: - model - settings _types.analysis.IcuCollationDecomposition: type: string enum: - 'no' - identical _types.aggregations.TDigestExecutionHint: type: string enum: - default - high_accuracy ml._types.ModelSnapshot: type: object properties: description: description: An optional description of the job. type: string job_id: description: A numerical character string that uniquely identifies the job that the snapshot was created for. allOf: - $ref: '#/components/schemas/_types.Id' latest_record_time_stamp: description: The timestamp of the latest processed record. type: number latest_result_time_stamp: description: The timestamp of the latest bucket result. type: number min_version: description: The minimum version required to be able to restore the model snapshot. allOf: - $ref: '#/components/schemas/_types.VersionString' model_size_stats: description: Summary information describing the model. allOf: - $ref: '#/components/schemas/ml._types.ModelSizeStats' retain: description: If true, this snapshot will not be deleted during automatic cleanup of snapshots older than model_snapshot_retention_days. However, this snapshot will be deleted when the job is deleted. The default value is false. type: boolean snapshot_doc_count: description: For internal use only. type: number snapshot_id: description: A numerical character string that uniquely identifies the model snapshot. allOf: - $ref: '#/components/schemas/_types.Id' timestamp: description: The creation timestamp for the snapshot. type: number required: - job_id - min_version - retain - snapshot_doc_count - snapshot_id - timestamp _types.query_dsl.GeoDistanceQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: distance: description: 'The radius of the circle centred on the specified location. Points which fall into this circle are considered to be matches.' allOf: - $ref: '#/components/schemas/_types.Distance' distance_type: description: "How to compute the distance.\nSet to `plane` for a faster calculation that's inaccurate on long distances and close to the poles.\n\nSupported values include:\n - `arc`: The `arc` calculation is the most accurate.\n - `plane`: The `plane` calculation is faster but less accurate.\n\n" default: '''arc''' allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' validation_method: description: "Set to `IGNORE_MALFORMED` to accept geo points with invalid latitude or longitude.\nSet to `COERCE` to also try to infer correct latitude or longitude.\n\nSupported values include:\n - `coerce`: Accept geo points with invalid latitude or longitude and additionally try and infer correct coordinates.\n - `ignore_malformed`: Accept geo points with invalid latitude or longitude.\n - `strict`\n\n" default: '''strict''' allOf: - $ref: '#/components/schemas/_types.query_dsl.GeoValidationMethod' ignore_unmapped: description: 'Set to `true` to ignore an unmapped field and not match any documents for this query. Set to `false` to throw an exception if the field is not mapped.' default: false type: boolean required: - distance _types.analysis.EdgeNGramTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - edge_ngram custom_token_chars: type: string max_gram: type: number min_gram: type: number token_chars: default: [] type: array items: $ref: '#/components/schemas/_types.analysis.TokenChar' required: - type _types.query_dsl.GeoDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBaseGeoLocationDistance' - type: object ml._types.CalendarEvent: type: object properties: calendar_id: description: A string that uniquely identifies a calendar. allOf: - $ref: '#/components/schemas/_types.Id' event_id: allOf: - $ref: '#/components/schemas/_types.Id' description: description: A description of the scheduled event. type: string end_time: description: The timestamp for the end of the scheduled event in milliseconds since the epoch or ISO 8601 format. allOf: - $ref: '#/components/schemas/_types.DateTime' start_time: description: The timestamp for the beginning of the scheduled event in milliseconds since the epoch or ISO 8601 format. allOf: - $ref: '#/components/schemas/_types.DateTime' skip_result: description: When true the model will not create results for this calendar period. default: true type: boolean skip_model_update: description: When true the model will not be updated for this calendar period. default: true type: boolean force_time_shift: description: Shift time by this many seconds. For example adjust time for daylight savings changes type: number required: - description - end_time - start_time _global.search._types.HighlighterType: anyOf: - type: string enum: - plain - fvh - unified - type: string _types.query_dsl.SimpleQueryStringFlags: description: Query flags can be either a single flag or a combination of flags, e.g. `OR|AND|PREFIX` allOf: - $ref: '#/components/schemas/_spec_utils.PipeSeparatedFlagsSimpleQueryStringFlag' _types.VersionType: type: string enum: - internal - external - external_gte _types.aggregations.ChiSquareHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean include_negatives: description: Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset. type: boolean required: - background_is_superset - include_negatives _types.query_dsl.HasChildQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: Indicates whether to ignore an unmapped `type` and not return any documents instead of an error. default: false type: boolean inner_hits: description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' max_children: description: 'Maximum number of child documents that match the query allowed for a returned parent document. If the parent document exceeds this limit, it is excluded from the search results.' type: number min_children: description: 'Minimum number of child documents that match the query required to match the query for a returned parent document. If the parent document does not meet this limit, it is excluded from the search results.' type: number query: description: 'Query you wish to run on child documents of the `type` field. If a child document matches the search, the query returns the parent document.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score_mode: description: Indicates how scores for matching child documents affect the root parent document’s relevance score. default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ChildScoreMode' type: description: Name of the child relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' required: - query - type _types.aggregations.PercentageScoreHeuristic: type: object _types.Routing: oneOf: - type: string - type: array items: type: string _types.analysis.HtmlStripCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - html_strip escaped_tags: type: array items: type: string required: - type _types.aggregations.MovingFunctionAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: script: description: The script that should be executed on each window of data. type: string shift: description: 'By default, the window consists of the last n values excluding the current bucket. Increasing `shift` by 1, moves the starting window position by 1 to the right.' default: 0.0 type: number window: description: The size of window to "slide" across the histogram. type: number _types.query_dsl.CombinedFieldsZeroTerms: type: string enum: - none - all _types.analysis.StemmerTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - stemmer language: type: string required: - type _types.analysis.SoraniNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - sorani_normalization required: - type _types.aggregations.MutualInformationHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean include_negatives: description: Set to `false` to filter out the terms that appear less often in the subset than in documents outside the subset. type: boolean _types.analysis.PatternCaptureTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - pattern_capture patterns: description: A list of regular expressions to match. type: array items: type: string preserve_original: description: If set to `true` (the default) it will emit the original token. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type - patterns _types.analysis.SynonymFormat: type: string enum: - solr - wordnet _types.analysis.PatternTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - pattern flags: type: string group: type: number pattern: type: string required: - type _types.query_dsl.RankFeatureFunctionLinear: allOf: - $ref: '#/components/schemas/_types.query_dsl.RankFeatureFunction' - type: object _types.query_dsl.ChildScoreMode: type: string enum: - none - avg - sum - max - min _types.aggregations.CompositeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: after: description: When paginating, use the `after_key` value returned in the previous response to retrieve the next page. allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregateKey' size: description: The number of composite buckets that should be returned. default: 10.0 type: number sources: description: 'The value sources used to build composite buckets. Keys are returned in the order of the `sources` definition.' type: array items: type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.CompositeAggregationSource' minProperties: 1 maxProperties: 1 _types.query_dsl.SpanGapQuery: description: Can only be used as a clause in a span_near query. type: object additionalProperties: type: number minProperties: 1 maxProperties: 1 _types.QueryVectorBuilder: type: object properties: text_embedding: allOf: - $ref: '#/components/schemas/_types.TextEmbedding' minProperties: 1 maxProperties: 1 _types.DateFormat: type: string _types.analysis.IcuCollationCaseFirst: type: string enum: - lower - upper _types.analysis.NGramTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - ngram max_gram: description: Maximum length of characters in a gram. Defaults to `2`. type: number min_gram: description: Minimum length of characters in a gram. Defaults to `1`. type: number preserve_original: description: Emits original token when set to `true`. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.Script: type: object properties: source: description: The script source. allOf: - $ref: '#/components/schemas/_types.ScriptSource' id: description: The `id` for a stored script. allOf: - $ref: '#/components/schemas/_types.Id' params: description: 'Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.' type: object additionalProperties: type: object lang: description: "Specifies the language the script is written in.\n\nSupported values include:\n - `painless`: Painless scripting language, purpose-built for Elasticsearch.\n - `expression`: Lucene’s expressions language, compiles a JavaScript expression to bytecode.\n - `mustache`: Mustache templated, used for templates.\n - `java`: Expert Java API\n\n" default: painless allOf: - $ref: '#/components/schemas/_types.ScriptLanguage' options: type: object additionalProperties: type: string ml._types.AnomalyExplanation: type: object properties: anomaly_characteristics_impact: description: Impact from the duration and magnitude of the detected anomaly relative to the historical average. type: number anomaly_length: description: Length of the detected anomaly in the number of buckets. type: number anomaly_type: description: 'Type of the detected anomaly: `spike` or `dip`.' type: string high_variance_penalty: description: Indicates reduction of anomaly score for the bucket with large confidence intervals. If a bucket has large confidence intervals, the score is reduced. type: boolean incomplete_bucket_penalty: description: If the bucket contains fewer samples than expected, the score is reduced. type: boolean lower_confidence_bound: description: Lower bound of the 95% confidence interval. type: number multi_bucket_impact: description: Impact of the deviation between actual and typical values in the past 12 buckets. type: number single_bucket_impact: description: Impact of the deviation between actual and typical values in the current bucket. type: number typical_value: description: Typical (expected) value for this bucket. type: number upper_confidence_bound: description: Upper bound of the 95% confidence interval. type: number _types.GeoDistanceType: type: string enum: - arc - plane _types.DurationLarge: description: 'A date histogram interval. Similar to `Duration` with additional units: `w` (week), `M` (month), `q` (quarter) and `y` (year)' type: string _types.aggregations.BucketKsAggregation: description: 'A sibling pipeline aggregation which executes a two sample Kolmogorov–Smirnov test (referred to as a "K-S test" from now on) against a provided distribution, and the distribution implied by the documents counts in the configured sibling aggregation. Specifically, for some metric, assuming that the percentile intervals of the metric are known beforehand or have been computed by an aggregation, then one would use range aggregation for the sibling to compute the p-value of the distribution difference between the metric and the restriction of that metric to a subset of the documents. A natural use case is if the sibling aggregation range aggregation nested in a terms aggregation, in which case one compares the overall distribution of metric to its restriction to each term.' allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: alternative: description: 'A list of string values indicating which K-S test alternative to calculate. The valid values are: "greater", "less", "two_sided". This parameter is key for determining the K-S statistic used when calculating the K-S test. Default value is all possible alternative hypotheses.' type: array items: type: string fractions: description: 'A list of doubles indicating the distribution of the samples with which to compare to the `buckets_path` results. In typical usage this is the overall proportion of documents in each bucket, which is compared with the actual document proportions in each bucket from the sibling aggregation counts. The default is to assume that overall documents are uniformly distributed on these buckets, which they would be if one used equal percentiles of a metric to define the bucket end points.' type: array items: type: number sampling_method: description: 'Indicates the sampling methodology when calculating the K-S test. Note, this is sampling of the returned values. This determines the cumulative distribution function (CDF) points used comparing the two samples. Default is `upper_tail`, which emphasizes the upper end of the CDF points. Valid options are: `upper_tail`, `uniform`, and `lower_tail`.' type: string _types.aggregations.BucketCorrelationAggregation: description: A sibling pipeline aggregation which executes a correlation function on the configured sibling multi-bucket aggregation. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketPathAggregation' - type: object properties: function: description: The correlation function to execute. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketCorrelationFunction' required: - function _types.aggregations.GeoHashGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: bounds: description: The bounding box to filter the points in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geohash_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: The string length of the geohashes used to define cells/buckets in the results. default: '5' allOf: - $ref: '#/components/schemas/_types.GeoHashPrecision' shard_size: description: 'Allows for more accurate counting of the top cells returned in the final result the aggregation. Defaults to returning `max(10,(size x number-of-shards))` buckets from each shard.' type: number size: description: The maximum number of geohash buckets to return. default: 10000.0 type: number _types.aggregations.GlobalAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object ml._types.DatafeedTimingStats: type: object properties: bucket_count: description: The number of buckets processed. type: number exponential_average_search_time_per_hour_ms: description: The exponential average search time per hour, in milliseconds. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' exponential_average_calculation_context: allOf: - $ref: '#/components/schemas/ml._types.ExponentialAverageCalculationContext' job_id: description: Identifier for the anomaly detection job. allOf: - $ref: '#/components/schemas/_types.Id' search_count: description: The number of searches run by the datafeed. type: number total_search_time_ms: description: The total time the datafeed spent searching, in milliseconds. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' average_search_time_per_bucket_ms: description: The average search time per bucket, in milliseconds. allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' required: - bucket_count - exponential_average_search_time_per_hour_ms - job_id - search_count - total_search_time_ms _types.NestedSortValue: type: object properties: filter: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' max_children: type: number nested: allOf: - $ref: '#/components/schemas/_types.NestedSortValue' path: allOf: - $ref: '#/components/schemas/_types.Field' required: - path _types.analysis.WhitespaceTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - whitespace max_token_length: type: number required: - type _types.analysis.KeepWordsTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keep keep_words: description: 'List of words to keep. Only tokens that match words in this list are included in the output. Either this parameter or `keep_words_path` must be specified.' type: array items: type: string keep_words_case: description: If `true`, lowercase all keep words. Defaults to `false`. type: boolean keep_words_path: description: 'Path to a file that contains a list of words to keep. Only tokens that match words in this list are included in the output. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each word in the file must be separated by a line break. Either this parameter or `keep_words` must be specified.' type: string required: - type _types.GeoTile: description: A map tile reference, represented as `{zoom}/{x}/{y}` type: string _types.aggregations.VariableWidthHistogramAggregation: type: object properties: field: description: The name of the field. allOf: - $ref: '#/components/schemas/_types.Field' buckets: description: The target number of buckets. default: 10.0 type: number shard_size: description: 'The number of buckets that the coordinating node will request from each shard. Defaults to `buckets * 50`.' type: number initial_buffer: description: 'Specifies the number of individual documents that will be stored in memory on a shard before the initial bucketing algorithm is run. Defaults to `min(10 * shard_size, 50000)`.' type: number script: allOf: - $ref: '#/components/schemas/_types.Script' _types.aggregations.MinBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.query_dsl.IntervalsPrefix: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string prefix: description: Beginning characters of terms you wish to find in the top-level field. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - prefix _types.RescoreVector: type: object properties: oversample: description: Applies the specified oversample factor to k on the approximate kNN search type: number required: - oversample ml._types.ConditionOperator: type: string enum: - gt - gte - lt - lte _types.aggregations.GoogleNormalizedDistanceHeuristic: type: object properties: background_is_superset: description: Set to `false` if you defined a custom background filter that represents a different set of documents that you want to compare to. type: boolean _types.analysis.KeywordTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - keyword buffer_size: default: 256.0 type: number required: - type _types.analysis.KuromojiReadingFormTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - kuromoji_readingform use_romaji: type: boolean required: - type - use_romaji _types.analysis.PhoneticRuleType: type: string enum: - approx - exact _types.query_dsl.IntervalsRange: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string gte: description: Lower term, either gte or gt must be provided. type: string gt: description: Lower term, either gte or gt must be provided. type: string lte: description: Upper term, either lte or lt must be provided. type: string lt: description: Upper term, either lte or lt must be provided. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' _types.GrokPattern: type: string _types.analysis.MinHashTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - min_hash bucket_count: description: Number of buckets to which hashes are assigned. Defaults to `512`. type: number hash_count: description: Number of ways to hash each token in the stream. Defaults to `1`. type: number hash_set_size: description: 'Number of hashes to keep from each bucket. Defaults to `1`. Hashes are retained by ascending size, starting with the bucket’s smallest hash first.' type: number with_rotation: description: If `true`, the filter fills empty buckets with the value of the first non-empty bucket to its circular right if the `hash_set_size` is `1`. If the `bucket_count` argument is greater than 1, this parameter defaults to `true`. Otherwise, this parameter defaults to `false`. type: boolean required: - type _types.query_dsl.RangeRelation: type: string enum: - within - contains - intersects ml._types.ExponentialAverageCalculationContext: type: object properties: incremental_metric_value_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' latest_timestamp: allOf: - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' previous_exponential_average_ms: allOf: - $ref: '#/components/schemas/_types.DurationValueUnitFloatMillis' required: - incremental_metric_value_ms _types.query_dsl.PercolateQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: document: description: The source of the document being percolated. type: object documents: description: An array of sources of the documents being percolated. type: array items: type: object field: description: Field that holds the indexed queries. The field must use the `percolator` mapping type. allOf: - $ref: '#/components/schemas/_types.Field' id: description: The ID of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.Id' index: description: The index of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.IndexName' name: description: The suffix used for the `_percolator_document_slot` field when multiple `percolate` queries are specified. type: string preference: description: Preference used to fetch document to percolate. type: string routing: description: Routing used to fetch document to percolate. allOf: - $ref: '#/components/schemas/_types.Routing' version: description: The expected version of a stored document to percolate. allOf: - $ref: '#/components/schemas/_types.VersionNumber' required: - field _types.aggregations.AverageBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.analysis.IcuTransformTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - icu_transform dir: allOf: - $ref: '#/components/schemas/_types.analysis.IcuTransformDirection' id: type: string required: - type - id _types.analysis.IcuNormalizationCharFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CharFilterBase' - type: object properties: type: type: string enum: - icu_normalizer mode: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationMode' name: allOf: - $ref: '#/components/schemas/_types.analysis.IcuNormalizationType' unicode_set_filter: type: string required: - type _types.analysis.FlattenGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - flatten_graph required: - type _types.aggregations.HdrMethod: type: object properties: number_of_significant_value_digits: description: Specifies the resolution of values for the histogram in number of significant digits. type: number _types.GeoHexCell: description: A map hex cell (H3) reference type: string _types.DistanceUnit: type: string enum: - in - ft - yd - mi - nmi - km - m - cm - mm _types.aggregations.CategorizeTextAggregation: description: 'A multi-bucket aggregation that groups semi-structured text into buckets. Each text field is re-analyzed using a custom analyzer. The resulting tokens are then categorized creating buckets of similarly formatted text values. This aggregation works best with machine generated text like system logs. Only the first 100 analyzed tokens are used to categorize the text.' allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: field: description: The semi-structured text field to categorize. allOf: - $ref: '#/components/schemas/_types.Field' max_unique_tokens: description: 'The maximum number of unique tokens at any position up to max_matched_tokens. Must be larger than 1. Smaller values use less memory and create fewer categories. Larger values will use more memory and create narrower categories. Max allowed value is 100.' default: 50.0 type: number max_matched_tokens: description: 'The maximum number of token positions to match on before attempting to merge categories. Larger values will use more memory and create narrower categories. Max allowed value is 100.' default: 5.0 type: number similarity_threshold: description: 'The minimum percentage of tokens that must match for text to be added to the category bucket. Must be between 1 and 100. The larger the value the narrower the categories. Larger values will increase memory usage and create narrower categories.' default: 50.0 type: number categorization_filters: description: 'This property expects an array of regular expressions. The expressions are used to filter out matching sequences from the categorization field values. You can use this functionality to fine tune the categorization by excluding sequences from consideration when categories are defined. For example, you can exclude SQL statements that appear in your log files. This property cannot be used at the same time as categorization_analyzer. If you only want to define simple regular expression filters that are applied prior to tokenization, setting this property is the easiest method. If you also want to customize the tokenizer or post-tokenization filtering, use the categorization_analyzer property instead and include the filters as pattern_replace character filters.' type: array items: type: string categorization_analyzer: externalDocs: url: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-analyze description: 'The categorization analyzer specifies how the text is analyzed and tokenized before being categorized. The syntax is very similar to that used to define the analyzer in the analyze API. This property cannot be used at the same time as `categorization_filters`.' allOf: - $ref: '#/components/schemas/_types.aggregations.CategorizeTextAnalyzer' shard_size: description: The number of categorization buckets to return from each shard before merging all the results. type: number size: description: The number of buckets to return. default: 10.0 type: number min_doc_count: description: The minimum number of documents in a bucket to be returned to the results. type: number shard_min_doc_count: description: The minimum number of documents in a bucket to be returned from the shard before merging. type: number required: - field _types.aggregations.ChangePointAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.query_dsl.MultiValueMode: type: string enum: - min - max - avg - sum _global.search._types.ScriptRescore: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' required: - script _types.analysis.WordDelimiterTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: catenate_all: description: If `true`, the filter produces catenated tokens for chains of alphanumeric characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean catenate_numbers: description: If `true`, the filter produces catenated tokens for chains of numeric characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean catenate_words: description: If `true`, the filter produces catenated tokens for chains of alphabetical characters separated by non-alphabetic delimiters. Defaults to `false`. type: boolean generate_number_parts: description: If `true`, the filter includes tokens consisting of only numeric characters in the output. If `false`, the filter excludes these tokens from the output. Defaults to `true`. type: boolean generate_word_parts: description: If `true`, the filter includes tokens consisting of only alphabetical characters in the output. If `false`, the filter excludes these tokens from the output. Defaults to `true`. type: boolean preserve_original: description: If `true`, the filter includes the original version of any split tokens in the output. This original version includes non-alphanumeric delimiters. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' protected_words: description: Array of tokens the filter won’t split. type: array items: type: string protected_words_path: description: 'Path to a file that contains a list of tokens the filter won’t split. This path must be absolute or relative to the `config` location, and the file must be UTF-8 encoded. Each token in the file must be separated by a line break.' type: string split_on_case_change: description: 'If `true`, the filter splits tokens at letter case transitions. For example: camelCase -> [ camel, Case ]. Defaults to `true`.' type: boolean split_on_numerics: description: 'If `true`, the filter splits tokens at letter-number transitions. For example: j2se -> [ j, 2, se ]. Defaults to `true`.' type: boolean stem_english_possessive: description: 'If `true`, the filter removes the English possessive (`''s`) from the end of each token. For example: O''Neil''s -> [ O, Neil ]. Defaults to `true`.' type: boolean type_table: description: Array of custom type mappings for characters. This allows you to map non-alphanumeric characters as numeric or alphanumeric to avoid splitting on those characters. type: array items: type: string type_table_path: description: Path to a file that contains custom type mappings for characters. This allows you to map non-alphanumeric characters as numeric or alphanumeric to avoid splitting on those characters. type: string _types.analysis.FingerprintTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - fingerprint max_output_size: description: Maximum character length, including whitespace, of the output token. Defaults to `255`. Concatenated tokens longer than this will result in no token output. type: number separator: description: Character to use to concatenate the token stream input. Defaults to a space. type: string required: - type _types.analysis.SynonymTokenFilterBase: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: expand: description: Expands definitions for equivalent synonym rules. Defaults to `true`. type: boolean format: description: Sets the synonym rules format. allOf: - $ref: '#/components/schemas/_types.analysis.SynonymFormat' lenient: description: If `true` ignores errors while parsing the synonym rules. It is important to note that only those synonym rules which cannot get parsed are ignored. Defaults to the value of the `updateable` setting. type: boolean synonyms: description: Used to define inline synonyms. type: array items: type: string synonyms_path: description: Used to provide a synonym file. This path must be absolute or relative to the `config` location. type: string synonyms_set: description: Provide a synonym set created via Synonyms Management APIs. type: string tokenizer: deprecated: true description: Controls the tokenizers that will be used to tokenize the synonym, this parameter is for backwards compatibility for indices that created before 6.0. type: string updateable: description: If `true` allows reloading search analyzers to pick up changes to synonym files. Only to be used for search analyzers. Defaults to `false`. type: boolean _types.query_dsl.MatchPhraseQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: description: Analyzer used to convert the text in the query value into tokens. type: string query: description: Query terms that are analyzed and turned into a phrase query. type: string slop: description: Maximum number of positions allowed between matching tokens. default: 0.0 type: number zero_terms_query: description: "Indicates whether no documents are returned if the `analyzer` removes all tokens, such as when using a `stop` filter.\n\nSupported values include:\n - `all`: Returns all documents, similar to a `match_all` query.\n - `none`: No documents are returned if the `analyzer` removes all tokens.\n\n" default: '''none''' allOf: - $ref: '#/components/schemas/_types.query_dsl.ZeroTermsQuery' required: - query _types.FieldValue: description: A field value. oneOf: - type: number - type: number - type: string - type: boolean - type: - string - 'null' _types.query_dsl.NumericDecayFunction: allOf: - $ref: '#/components/schemas/_types.query_dsl.DecayFunctionBasedoubledouble' - type: object _types.aggregations.BucketSortAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.Aggregation' - type: object properties: from: description: Buckets in positions prior to `from` will be truncated. type: number gap_policy: description: "The policy to apply when gaps are found in the data.\n\nSupported values include:\n - `skip`: Treats missing data as if the bucket does not exist. It will skip the bucket and\ncontinue calculating using the next available value.\n - `insert_zeros`: Replace missing values with a zero (0) and pipeline aggregation computation will proceed as normal.\n - `keep_values`: Similar to skip, except if the metric provides a non-null, non-NaN value this value is used,\notherwise the empty bucket is skipped.\n\n" default: skip allOf: - $ref: '#/components/schemas/_types.aggregations.GapPolicy' size: description: 'The number of buckets to return. Defaults to all buckets of the parent aggregation.' type: number sort: description: The list of fields to sort on. allOf: - $ref: '#/components/schemas/_types.Sort' _types.analysis.ScandinavianFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - scandinavian_folding required: - type _types.aggregations.MetricAggregationBase: type: object properties: field: description: The field on which to run the aggregation. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.aggregations.Missing' script: allOf: - $ref: '#/components/schemas/_types.Script' _types.GeoHashPrecision: description: A precision that can be expressed as a geohash length between 1 and 12, or a distance measure like "1km", "10m". oneOf: - type: number - type: string _types.DurationValueUnitSeconds: allOf: - $ref: '#/components/schemas/_types.UnitSeconds' _types.aggregations.ExtendedBoundsFieldDateMath: type: object properties: max: description: Maximum value for the bound. allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' min: description: Minimum value for the bound. allOf: - $ref: '#/components/schemas/_types.aggregations.FieldDateMath' _types.analysis.NoriTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - nori_tokenizer decompound_mode: allOf: - $ref: '#/components/schemas/_types.analysis.NoriDecompoundMode' discard_punctuation: type: boolean user_dictionary: type: string user_dictionary_rules: type: array items: type: string required: - type _types.aggregations.MinAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object _types.analysis.GermanStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - german_stem required: - type _types.query_dsl.DecayFunctionBaseDateMathDuration: type: object properties: multi_value_mode: description: "Determines how the distance is calculated when a field used for computing the decay contains multiple values.\n\nSupported values include:\n - `min`: Distance is the minimum distance.\n - `max`: Distance is the maximum distance.\n - `avg`: Distance is the average distance.\n - `sum`: Distance is the sum of all distances.\n\n" default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.aggregations.HistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: extended_bounds: description: Enables extending the bounds of the histogram beyond the data itself. allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble' hard_bounds: description: 'Limits the range of buckets in the histogram. It is particularly useful in the case of open data ranges that can result in a very large number of buckets.' allOf: - $ref: '#/components/schemas/_types.aggregations.ExtendedBoundsdouble' field: description: The name of the field to aggregate on. allOf: - $ref: '#/components/schemas/_types.Field' interval: description: 'The interval for the buckets. Must be a positive decimal.' type: number min_doc_count: description: 'Only returns buckets that have `min_doc_count` number of documents. By default, the response will fill gaps in the histogram with empty buckets.' type: number missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: number offset: description: 'By default, the bucket keys start with 0 and then continue in even spaced steps of `interval`. The bucket boundaries can be shifted by using the `offset` option.' type: number order: description: 'The sort order of the returned buckets. By default, the returned buckets are sorted by their key ascending.' allOf: - $ref: '#/components/schemas/_types.aggregations.AggregateOrder' script: allOf: - $ref: '#/components/schemas/_types.Script' format: type: string keyed: description: If `true`, returns buckets as a hash instead of an array, keyed by the bucket keys. default: false type: boolean _types.ulong: type: number _types.query_dsl.NumberRangeQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.RangeQueryBasedouble' - type: object _types.analysis.TokenizerBase: type: object properties: version: allOf: - $ref: '#/components/schemas/_types.VersionString' _types.query_dsl.Operator: type: string enum: - and - AND - or - OR _types.query_dsl.IntervalsRegexp: type: object properties: analyzer: description: Analyzer used to analyze the `prefix`. type: string pattern: description: Regex pattern. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `prefix` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' required: - pattern _types.query_dsl.FieldValueFactorModifier: type: string enum: - none - log - log1p - log2p - ln - ln1p - ln2p - square - sqrt - reciprocal _types.aggregations.TopMetricsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: metrics: description: The fields of the top document to return. oneOf: - $ref: '#/components/schemas/_types.aggregations.TopMetricsValue' - type: array items: $ref: '#/components/schemas/_types.aggregations.TopMetricsValue' size: description: The number of top documents from which to return metrics. default: 1.0 type: number sort: description: The sort order of the documents. allOf: - $ref: '#/components/schemas/_types.Sort' _types.aggregations.HoltLinearModelSettings: type: object properties: alpha: type: number beta: type: number _types.query_dsl.WrapperQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: query: description: 'A base64 encoded query. The binary data format can be any of JSON, YAML, CBOR or SMILE encodings' type: string required: - query _types.DateTime: description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.' oneOf: - type: string - $ref: '#/components/schemas/_types.EpochTimeUnitMillis' _types.aggregations.SamplerAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: shard_size: description: Limits how many top-scoring documents are collected in the sample processed on each shard. default: 100.0 type: number _types.aggregations.PercentilesAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: keyed: description: 'By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array. Set to `false` to disable this behavior.' default: true type: boolean percents: description: The percentiles to calculate. oneOf: - type: number - type: array items: type: number hdr: description: Uses the alternative High Dynamic Range Histogram algorithm to calculate percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.HdrMethod' tdigest: description: Sets parameters for the default TDigest algorithm used to calculate percentiles. allOf: - $ref: '#/components/schemas/_types.aggregations.TDigest' _types.RRFRetrieverEntry: description: Either a direct RetrieverContainer (backward compatible) or an RRFRetrieverComponent with weight. oneOf: - $ref: '#/components/schemas/_types.RetrieverContainer' - $ref: '#/components/schemas/_types.RRFRetrieverComponent' ml._types.DetectorUpdate: type: object properties: detector_index: description: 'A unique identifier for the detector. This identifier is based on the order of the detectors in the `analysis_config`, starting at zero.' type: number description: description: A description of the detector. type: string custom_rules: description: 'An array of custom rule objects, which enable you to customize the way detectors operate. For example, a rule may dictate to the detector conditions under which results should be skipped. Kibana refers to custom rules as job rules.' type: array items: $ref: '#/components/schemas/ml._types.DetectionRule' required: - detector_index _types.query_dsl.MoreLikeThisQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: analyzer: externalDocs: url: https://www.elastic.co/docs/manage-data/data-store/text-analysis description: 'The analyzer that is used to analyze the free form text. Defaults to the analyzer associated with the first field in fields.' type: string boost_terms: description: 'Each term in the formed query could be further boosted by their tf-idf score. This sets the boost factor to use when using this feature. Defaults to deactivated (0).' default: 0.0 type: number fail_on_unsupported_field: description: Controls whether the query should fail (throw an exception) if any of the specified fields are not of the supported types (`text` or `keyword`). default: true type: boolean fields: description: 'A list of fields to fetch and analyze the text from. Defaults to the `index.query.default_field` index setting, which has a default value of `*`.' type: array items: $ref: '#/components/schemas/_types.Field' include: description: Specifies whether the input documents should also be included in the search results returned. default: false type: boolean like: description: Specifies free form text and/or a single or multiple documents for which you want to find similar documents. oneOf: - $ref: '#/components/schemas/_types.query_dsl.Like' - type: array items: $ref: '#/components/schemas/_types.query_dsl.Like' max_doc_freq: description: The maximum document frequency above which the terms are ignored from the input document. type: number max_query_terms: description: The maximum number of query terms that can be selected. default: 25.0 type: number max_word_length: description: 'The maximum word length above which the terms are ignored. Defaults to unbounded (`0`).' default: 0.0 type: number min_doc_freq: description: The minimum document frequency below which the terms are ignored from the input document. default: 5.0 type: number minimum_should_match: description: After the disjunctive query has been formed, this parameter controls the number of terms that must match. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' min_term_freq: description: The minimum term frequency below which the terms are ignored from the input document. default: 2.0 type: number min_word_length: description: The minimum word length below which the terms are ignored. default: 0.0 type: number routing: allOf: - $ref: '#/components/schemas/_types.Routing' stop_words: description: 'An array of stop words. Any word in this set is ignored.' allOf: - $ref: '#/components/schemas/_types.analysis.StopWords' unlike: description: Used in combination with `like` to exclude documents that match a set of terms. oneOf: - $ref: '#/components/schemas/_types.query_dsl.Like' - type: array items: $ref: '#/components/schemas/_types.query_dsl.Like' version: allOf: - $ref: '#/components/schemas/_types.VersionNumber' version_type: description: "\n\nSupported values include:\n - `internal`: Use internal versioning that starts at 1 and increments with each update or delete.\n - `external`: Only index the document if the specified version is strictly higher than the version of the stored document or if there is no existing document.\n - `external_gte`: Only index the document if the specified version is equal or higher than the version of the stored document or if there is no existing document.\nNOTE: The `external_gte` version type is meant for special use cases and should be used with care.\nIf used incorrectly, it can result in loss of data.\n\n" default: '''internal''' allOf: - $ref: '#/components/schemas/_types.VersionType' required: - like _types.query_dsl.BoolQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: filter: description: 'The clause (query) must appear in matching documents. However, unlike `must`, the score of the query will be ignored.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' minimum_should_match: description: Specifies the number or percentage of `should` clauses returned documents must match. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' must: description: The clause (query) must appear in matching documents and will contribute to the score. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' must_not: description: 'The clause (query) must not appear in the matching documents. Because scoring is ignored, a score of `0` is returned for all documents.' oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' should: description: The clause (query) should appear in the matching document. oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' ml._types.DataCounts: type: object properties: bucket_count: type: number earliest_record_timestamp: type: number empty_bucket_count: type: number input_bytes: type: number input_field_count: type: number input_record_count: type: number invalid_date_count: type: number job_id: allOf: - $ref: '#/components/schemas/_types.Id' last_data_time: type: number latest_empty_bucket_timestamp: type: number latest_record_timestamp: type: number latest_sparse_bucket_timestamp: type: number latest_bucket_timestamp: type: number log_time: type: number missing_field_count: type: number out_of_order_timestamp_count: type: number processed_field_count: type: number processed_record_count: type: number sparse_bucket_count: type: number required: - bucket_count - empty_bucket_count - input_bytes - input_field_count - input_record_count - invalid_date_count - job_id - missing_field_count - out_of_order_timestamp_count - processed_field_count - processed_record_count - sparse_bucket_count _types.aggregations.ValueCountAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormattableMetricAggregation' - type: object _types.analysis.CzechStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - czech_stem required: - type _types.analysis.AsciiFoldingTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - asciifolding preserve_original: description: If `true`, emit both original tokens and folded tokens. Defaults to `false`. allOf: - $ref: '#/components/schemas/_spec_utils.Stringifiedboolean' required: - type _types.analysis.LowercaseTokenFilterLanguages: type: string enum: - greek - irish - turkish _types.aggregations.SumBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object _types.aggregations.CartesianCentroidAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object ml._types.CustomSettings: description: Custom metadata about the job type: object _types.query_dsl.HasParentQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: ignore_unmapped: description: 'Indicates whether to ignore an unmapped `parent_type` and not return any documents instead of an error. You can use this parameter to query multiple indices that may not contain the `parent_type`.' default: false type: boolean inner_hits: description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' parent_type: description: Name of the parent relationship mapped for the `join` field. allOf: - $ref: '#/components/schemas/_types.RelationName' query: description: 'Query you wish to run on parent documents of the `parent_type` field. If a parent document matches the search, the query returns its child documents.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' score: description: Indicates whether the relevance score of a matching parent document is aggregated into its child documents. default: false type: boolean required: - parent_type - query _types.query_dsl.QueryStringQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: allow_leading_wildcard: description: If `true`, the wildcard characters `*` and `?` are allowed as the first character of the query string. default: true type: boolean analyzer: description: Analyzer used to convert text in the query string into tokens. type: string analyze_wildcard: description: If `true`, the query attempts to analyze wildcard terms in the query string. default: false type: boolean auto_generate_synonyms_phrase_query: description: If `true`, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean default_field: description: 'Default field to search if no field is provided in the query string. Supports wildcards (`*`). Defaults to the `index.query.default_field` index setting, which has a default value of `*`.' allOf: - $ref: '#/components/schemas/_types.Field' default_operator: description: Default boolean logic used to interpret text in the query string if no operators are specified. default: '''or''' allOf: - $ref: '#/components/schemas/_types.query_dsl.Operator' enable_position_increments: description: If `true`, enable position increments in queries constructed from a `query_string` search. default: true type: boolean escape: default: false type: boolean fields: description: Array of fields to search. Supports wildcards (`*`). type: array items: $ref: '#/components/schemas/_types.Field' fuzziness: description: Maximum edit distance allowed for fuzzy matching. allOf: - $ref: '#/components/schemas/_types.Fuzziness' fuzzy_max_expansions: description: Maximum number of terms to which the query expands for fuzzy matching. default: 50.0 type: number fuzzy_prefix_length: description: Number of beginning characters left unchanged for fuzzy matching. default: 0.0 type: number fuzzy_rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' fuzzy_transpositions: description: If `true`, edits for fuzzy matching include transpositions of two adjacent characters (for example, `ab` to `ba`). default: true type: boolean lenient: description: If `true`, format-based errors, such as providing a text value for a numeric field, are ignored. default: false type: boolean max_determinized_states: description: Maximum number of automaton states required for the query. default: 10000.0 type: number minimum_should_match: description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' phrase_slop: description: Maximum number of positions allowed between matching tokens for phrases. default: 0.0 type: number query: description: Query string you wish to parse and use for search. type: string quote_analyzer: description: 'Analyzer used to convert quoted text in the query string into tokens. For quoted text, this parameter overrides the analyzer specified in the `analyzer` parameter.' type: string quote_field_suffix: description: 'Suffix appended to quoted text in the query string. You can use this suffix to use a different analysis method for exact matches.' type: string rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' tie_breaker: description: How to combine the queries generated from the individual search terms in the resulting `dis_max` query. type: number time_zone: description: Coordinated Universal Time (UTC) offset or IANA time zone used to convert date values in the query string to UTC. allOf: - $ref: '#/components/schemas/_types.TimeZone' type: description: "Determines how the query matches and scores documents.\n\nSupported values include:\n - `best_fields`: Finds documents that match any field, but uses the `_score` from the best field.\n - `most_fields`: Finds documents that match any field and combines the `_score` from each field.\n - `cross_fields`: Treats fields with the same analyzer as though they were one big field.\nLooks for each word in any field.\n - `phrase`: Runs a `match_phrase` query on each field and uses the `_score` from the best field.\n - `phrase_prefix`: Runs a `match_phrase_prefix` query on each field and uses the `_score` from the best field.\n - `bool_prefix`: Creates a `match_bool_prefix` query on each field and combines the `_score` from each field.\n\n" default: '''best_fields''' allOf: - $ref: '#/components/schemas/_types.query_dsl.TextQueryType' required: - query _types.analysis.HyphenationDecompounderTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.CompoundWordTokenFilterBase' - type: object properties: type: type: string enum: - hyphenation_decompounder hyphenation_patterns_path: description: 'Path to an Apache FOP (Formatting Objects Processor) XML hyphenation pattern file. This path must be absolute or relative to the `config` location. Only FOP v1.2 compatible files are supported.' type: string no_sub_matches: description: If `true`, do not match sub tokens in tokens that are in the word list. Defaults to `false`. type: boolean no_overlapping_matches: description: If `true`, do not allow overlapping tokens. Defaults to `false`. type: boolean required: - type - hyphenation_patterns_path _types.aggregations.StatsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object ml._types.FilterRef: type: object properties: filter_id: description: The identifier for the filter. allOf: - $ref: '#/components/schemas/_types.Id' filter_type: description: If set to `include`, the rule applies for values in the filter. If set to `exclude`, the rule applies for values not in the filter. default: include allOf: - $ref: '#/components/schemas/ml._types.FilterType' required: - filter_id ml._types.RuleCondition: type: object properties: applies_to: description: Specifies the result property to which the condition applies. If your detector uses `lat_long`, `metric`, `rare`, or `freq_rare` functions, you can only specify conditions that apply to time. allOf: - $ref: '#/components/schemas/ml._types.AppliesTo' operator: description: Specifies the condition operator. The available options are greater than, greater than or equals, less than, and less than or equals. allOf: - $ref: '#/components/schemas/ml._types.ConditionOperator' value: description: The value that is compared against the `applies_to` field using the operator. type: number required: - applies_to - operator - value _types.analysis.PredicateTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - predicate_token_filter script: description: Script containing a condition used to filter incoming tokens. Only tokens that match this script are included in the output. allOf: - $ref: '#/components/schemas/_types.Script' required: - type - script _types.mapping.RuntimeFieldFetchFields: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' format: type: string required: - field _types.analysis.ClassicTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - classic required: - type _types.DateMath: type: string ml._types.Detector: type: object properties: by_field_name: description: The field used to split the data. In particular, this property is used for analyzing the splits with respect to their own history. It is used for finding unusual values in the context of the split. allOf: - $ref: '#/components/schemas/_types.Field' custom_rules: description: Custom rules enable you to customize the way detectors operate. For example, a rule may dictate conditions under which results should be skipped. Kibana refers to custom rules as job rules. type: array items: $ref: '#/components/schemas/ml._types.DetectionRule' detector_description: description: A description of the detector. type: string detector_index: description: A unique identifier for the detector. This identifier is based on the order of the detectors in the `analysis_config`, starting at zero. If you specify a value for this property, it is ignored. type: number exclude_frequent: description: If set, frequent entities are excluded from influencing the anomaly results. Entities can be considered frequent over time or frequent in a population. If you are working with both over and by fields, you can set `exclude_frequent` to `all` for both fields, or to `by` or `over` for those specific fields. allOf: - $ref: '#/components/schemas/ml._types.ExcludeFrequent' field_name: description: The field that the detector uses in the function. If you use an event rate function such as count or rare, do not specify this field. The `field_name` cannot contain double quotes or backslashes. allOf: - $ref: '#/components/schemas/_types.Field' function: description: The analysis function that is used. For example, `count`, `rare`, `mean`, `min`, `max`, or `sum`. type: string over_field_name: description: The field used to split the data. In particular, this property is used for analyzing the splits with respect to the history of all splits. It is used for finding unusual values in the population of all splits. allOf: - $ref: '#/components/schemas/_types.Field' partition_field_name: description: The field used to segment the analysis. When you use this property, you have completely independent baselines for each value of this field. allOf: - $ref: '#/components/schemas/_types.Field' use_null: description: Defines whether a new series is used as the null series when there is no value for the by or partition fields. default: false type: boolean _types.InnerRetriever: type: object properties: retriever: allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' weight: type: number normalizer: allOf: - $ref: '#/components/schemas/_types.ScoreNormalizer' required: - retriever - weight - normalizer _types.aggregations.CompositeGeoTileGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: precision: type: number bounds: allOf: - $ref: '#/components/schemas/_types.GeoBounds' _types.aggregations.CartesianBoundsAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object _types.analysis.TokenFilter: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/token-filter-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.TokenFilterDefinition' _global.search._types.HighlighterEncoder: type: string enum: - default - html _types.query_dsl.RankFeatureFunction: type: object _types.query_dsl.SpanNotQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: dist: description: 'The number of tokens from within the include span that can’t have overlap with the exclude span. Equivalent to setting both `pre` and `post`.' type: number exclude: description: Span query whose matches must not overlap those returned. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' include: description: Span query whose matches are filtered. allOf: - $ref: '#/components/schemas/_types.query_dsl.SpanQuery' post: description: The number of tokens after the include span that can’t have overlap with the exclude span. default: 0.0 type: number pre: description: The number of tokens before the include span that can’t have overlap with the exclude span. default: 0.0 type: number required: - exclude - include _types.aggregations.ExtendedStatsBucketAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object properties: sigma: description: The number of standard deviations above/below the mean to display. type: number _types.query_dsl.RegexpQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: case_insensitive: description: 'Allows case insensitive matching of the regular expression value with the indexed field values when set to `true`. When `false`, case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean flags: description: Enables optional operators for the regular expression. type: string max_determinized_states: description: Maximum number of automaton states required for the query. default: 10000.0 type: number rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Regular expression for terms you wish to find in the provided field. type: string required: - value _types.query_dsl.ConstantScoreQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: filter: description: 'Filter query you wish to run. Any returned documents must match this query. Filter queries do not calculate relevance scores. To speed up performance, Elasticsearch automatically caches frequently used filter queries.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' required: - filter ml._types.ModelSnapshotUpgrade: type: object properties: job_id: allOf: - $ref: '#/components/schemas/_types.Id' snapshot_id: allOf: - $ref: '#/components/schemas/_types.Id' state: allOf: - $ref: '#/components/schemas/ml._types.SnapshotUpgradeState' node: x-state: Generally available allOf: - $ref: '#/components/schemas/ml._types.DiscoveryNode' assignment_explanation: type: string required: - job_id - snapshot_id - state - node - assignment_explanation _types.aggregations.CompositeDateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.CompositeAggregationBase' - type: object properties: format: type: string calendar_interval: description: Either `calendar_interval` or `fixed_interval` must be present allOf: - $ref: '#/components/schemas/_types.DurationLarge' fixed_interval: description: Either `calendar_interval` or `fixed_interval` must be present allOf: - $ref: '#/components/schemas/_types.DurationLarge' offset: allOf: - $ref: '#/components/schemas/_types.Duration' time_zone: allOf: - $ref: '#/components/schemas/_types.TimeZone' _types.aggregations.AdjacencyMatrixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: filters: description: 'Filters used to create buckets. At least one filter is required.' type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' separator: description: Separator used to concatenate filter names. Defaults to &. type: string _types.query_dsl.GeoDistanceFeatureQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.DistanceFeatureQueryBaseGeoLocationDistance' - type: object _types.aggregations.RangeAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The date field whose values are use to build ranges. allOf: - $ref: '#/components/schemas/_types.Field' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' type: number ranges: description: An array of ranges used to bucket documents. type: array items: $ref: '#/components/schemas/_types.aggregations.AggregationRange' script: allOf: - $ref: '#/components/schemas/_types.Script' keyed: description: Set to `true` to associate a unique string key with each bucket and return the ranges as a hash rather than an array. type: boolean format: type: string _types.query_dsl.DecayFunctionBasedoubledouble: type: object properties: multi_value_mode: description: "Determines how the distance is calculated when a field used for computing the decay contains multiple values.\n\nSupported values include:\n - `min`: Distance is the minimum distance.\n - `max`: Distance is the maximum distance.\n - `avg`: Distance is the average distance.\n - `sum`: Distance is the sum of all distances.\n\n" default: min allOf: - $ref: '#/components/schemas/_types.query_dsl.MultiValueMode' _types.query_dsl.PrefixQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: rewrite: description: Method used to rewrite the query. allOf: - $ref: '#/components/schemas/_types.MultiTermQueryRewrite' value: description: Beginning characters of terms you wish to find in the provided field. type: string case_insensitive: description: 'Allows ASCII case insensitive matching of the value with the indexed field values when set to `true`. Default is `false` which means the case sensitivity of matching depends on the underlying field’s mapping.' default: false x-state: Generally available; Added in 7.10.0 type: boolean required: - value _types.aggregations.CardinalityExecutionMode: type: string enum: - global_ordinals - segment_ordinals - direct - save_memory_heuristic - save_time_heuristic _types.aggregations.AutoDateHistogramAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: buckets: description: The target number of buckets. default: 10.0 type: number field: description: The field on which to run the aggregation. allOf: - $ref: '#/components/schemas/_types.Field' format: description: 'The date format used to format `key_as_string` in the response. If no `format` is specified, the first date format specified in the field mapping is used.' type: string minimum_interval: description: 'The minimum rounding interval. This can make the collection process more efficient, as the aggregation will not attempt to round at any interval lower than `minimum_interval`.' allOf: - $ref: '#/components/schemas/_types.aggregations.MinimumInterval' missing: description: 'The value to apply to documents that do not have a value. By default, documents without a value are ignored.' allOf: - $ref: '#/components/schemas/_types.DateTime' offset: description: Time zone specified as a ISO 8601 UTC offset. type: string params: type: object additionalProperties: type: object script: allOf: - $ref: '#/components/schemas/_types.Script' time_zone: description: Time zone ID. allOf: - $ref: '#/components/schemas/_types.TimeZone' _types.query_dsl.WeightedTokensQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: tokens: description: The tokens representing this query oneOf: - type: object additionalProperties: type: number - type: array items: type: object additionalProperties: type: number pruning_config: description: Token pruning configurations allOf: - $ref: '#/components/schemas/_types.TokenPruningConfig' required: - tokens _types.analysis.KuromojiTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - kuromoji_tokenizer discard_punctuation: type: boolean mode: allOf: - $ref: '#/components/schemas/_types.analysis.KuromojiTokenizationMode' nbest_cost: type: number nbest_examples: type: string user_dictionary: type: string user_dictionary_rules: type: array items: type: string discard_compound_token: type: boolean required: - type - mode _types.analysis.KuromojiTokenizationMode: type: string enum: - normal - search - extended ml._types.DiscoveryNode: type: object additionalProperties: $ref: '#/components/schemas/ml._types.DiscoveryNodeContent' minProperties: 1 maxProperties: 1 _types.query_dsl.TextQueryType: type: string enum: - best_fields - most_fields - cross_fields - phrase - phrase_prefix - bool_prefix _types.aggregations.NormalizeMethod: type: string enum: - rescale_0_1 - rescale_0_100 - percent_of_sum - mean - z-score - softmax _types.ScriptLanguage: anyOf: - type: string enum: - painless - expression - mustache - java - type: string _types.aggregations.GapPolicy: type: string enum: - skip - insert_zeros - keep_values _types.analysis.HunspellTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - hunspell dedup: description: If `true`, duplicate tokens are removed from the filter’s output. Defaults to `true`. type: boolean dictionary: description: 'One or more `.dic` files (e.g, `en_US.dic`, my_custom.dic) to use for the Hunspell dictionary. By default, the `hunspell` filter uses all `.dic` files in the `<$ES_PATH_CONF>/hunspell/` directory specified using the `lang`, `language`, or `locale` parameter.' type: string locale: description: Locale directory used to specify the `.aff` and `.dic` files for a Hunspell dictionary. type: string longest_only: description: If `true`, only the longest stemmed version of each token is included in the output. If `false`, all stemmed versions of the token are included. Defaults to `false`. type: boolean required: - type - locale _types.aggregations.CumulativeCardinalityAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.PipelineAggregationBase' - type: object ml._types.JobStatistics: type: object properties: avg: type: number max: type: number min: type: number total: type: number required: - avg - max - min - total _types.aggregations.CalendarInterval: type: string enum: - second - 1s - minute - 1m - hour - 1h - day - 1d - week - 1w - month - 1M - quarter - 1q - year - 1y _types.aggregations.HoltWintersType: type: string enum: - add - mult _types.aggregations.FiltersAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: filters: description: Collection of queries from which to build buckets. allOf: - $ref: '#/components/schemas/_types.aggregations.BucketsQueryContainer' other_bucket: description: Set to `true` to add a bucket to the response which will contain all documents that do not match any of the given filters. type: boolean other_bucket_key: description: The key with which the other bucket is returned. default: _other_ type: string keyed: description: 'By default, the named filters aggregation returns the buckets as an object. Set to `false` to return the buckets as an array of objects.' default: true type: boolean _types.query_dsl.IntervalsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-intervals-query type: object properties: all_of: description: Returns matches that span a combination of other rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAllOf' any_of: description: Returns intervals produced by any of its sub-rules. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsAnyOf' fuzzy: description: Matches terms that are similar to the provided term, within an edit distance defined by `fuzziness`. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFuzzy' match: description: Matches analyzed text. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsMatch' prefix: description: Matches terms that start with a specified set of characters. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsPrefix' range: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRange' regexp: allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsRegexp' wildcard: description: Matches terms using a wildcard pattern. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsWildcard' minProperties: 1 maxProperties: 1 _types.MinimumShouldMatch: description: The minimum number of terms that should match as integer, percentage or range oneOf: - type: number - type: string _types.aggregations.HoltWintersMovingAverageAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MovingAverageAggregationBase' - type: object properties: model: type: string enum: - holt_winters settings: allOf: - $ref: '#/components/schemas/_types.aggregations.HoltWintersModelSettings' required: - model - settings _types.IndexName: type: string _types.analysis.WordDelimiterGraphTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilterBase' - type: object properties: type: type: string enum: - word_delimiter_graph adjust_offsets: description: If `true`, the filter adjusts the offsets of split or catenated tokens to better reflect their actual position in the token stream. Defaults to `true`. type: boolean ignore_keywords: description: If `true`, the filter skips tokens with a keyword attribute of true. Defaults to `false`. type: boolean required: - type _types.GeoBounds: description: 'A geo bounding box. It can be represented in various ways: - as 4 top/bottom/left/right coordinates - as 2 top_left / bottom_right points - as 2 top_right / bottom_left points - as a WKT bounding box' oneOf: - $ref: '#/components/schemas/_types.CoordsGeoBounds' - $ref: '#/components/schemas/_types.TopLeftBottomRightGeoBounds' - $ref: '#/components/schemas/_types.TopRightBottomLeftGeoBounds' - $ref: '#/components/schemas/_types.WktGeoBounds' _types.Fields: oneOf: - $ref: '#/components/schemas/_types.Field' - type: array items: $ref: '#/components/schemas/_types.Field' _types.analysis.FrenchStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - french_stem required: - type _types.analysis.Tokenizer: externalDocs: url: https://www.elastic.co/docs/reference/text-analysis/tokenizer-reference oneOf: - type: string - $ref: '#/components/schemas/_types.analysis.TokenizerDefinition' _types.UnitSeconds: description: Time unit for seconds type: number _types.query_dsl.CombinedFieldsQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: fields: description: List of fields to search. Field wildcard patterns are allowed. Only `text` fields are supported, and they must all have the same search `analyzer`. type: array items: $ref: '#/components/schemas/_types.Field' query: description: 'Text to search for in the provided `fields`. The `combined_fields` query analyzes the provided text before performing a search.' type: string auto_generate_synonyms_phrase_query: description: If true, match phrase queries are automatically created for multi-term synonyms. default: true type: boolean operator: description: Boolean logic used to interpret text in the query value. default: or allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsOperator' minimum_should_match: externalDocs: url: https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-minimum-should-match description: Minimum number of clauses that must match for a document to be returned. allOf: - $ref: '#/components/schemas/_types.MinimumShouldMatch' zero_terms_query: description: "Indicates whether no documents are returned if the analyzer removes all tokens, such as when using a `stop` filter.\n\nSupported values include:\n - `none`: No documents are returned if the analyzer removes all tokens.\n - `all`: Returns all documents, similar to a `match_all` query.\n\n" default: none allOf: - $ref: '#/components/schemas/_types.query_dsl.CombinedFieldsZeroTerms' required: - fields - query _global.search._types.Rescore: allOf: - type: object properties: window_size: type: number - type: object properties: query: allOf: - $ref: '#/components/schemas/_global.search._types.RescoreQuery' learning_to_rank: allOf: - $ref: '#/components/schemas/_global.search._types.LearningToRank' script: allOf: - $ref: '#/components/schemas/_global.search._types.ScriptRescore' minProperties: 1 maxProperties: 1 _types.analysis.StopWords: description: 'Language value, such as _arabic_ or _thai_. Defaults to _english_. Each language value corresponds to a predefined list of stop words in Lucene. See Stop words by language for supported language values and their stop words. Also accepts an array of stop words.' oneOf: - $ref: '#/components/schemas/_types.analysis.StopWordLanguage' - type: array items: type: string _types.aggregations.PercentileRanksAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.FormatMetricAggregationBase' - type: object properties: keyed: description: 'By default, the aggregation associates a unique string key with each bucket and returns the ranges as a hash rather than an array. Set to `false` to disable this behavior.' default: true type: boolean values: description: An array of values for which to calculate the percentile ranks. oneOf: - type: array items: type: number - type: - string - 'null' hdr: description: Uses the alternative High Dynamic Range Histogram algorithm to calculate percentile ranks. allOf: - $ref: '#/components/schemas/_types.aggregations.HdrMethod' tdigest: description: Sets parameters for the default TDigest algorithm used to calculate percentile ranks. allOf: - $ref: '#/components/schemas/_types.aggregations.TDigest' ml._types.ModelSizeStats: type: object properties: bucket_allocation_failures_count: type: number job_id: allOf: - $ref: '#/components/schemas/_types.Id' log_time: allOf: - $ref: '#/components/schemas/_types.DateTime' memory_status: allOf: - $ref: '#/components/schemas/ml._types.MemoryStatus' model_bytes: allOf: - $ref: '#/components/schemas/_types.ByteSize' model_bytes_exceeded: allOf: - $ref: '#/components/schemas/_types.ByteSize' model_bytes_memory_limit: allOf: - $ref: '#/components/schemas/_types.ByteSize' output_memory_allocator_bytes: allOf: - $ref: '#/components/schemas/_types.ByteSize' peak_model_bytes: allOf: - $ref: '#/components/schemas/_types.ByteSize' assignment_memory_basis: type: string result_type: type: string total_by_field_count: type: number total_over_field_count: type: number total_partition_field_count: type: number categorization_status: allOf: - $ref: '#/components/schemas/ml._types.CategorizationStatus' categorized_doc_count: type: number dead_category_count: type: number failed_category_count: type: number frequent_category_count: type: number rare_category_count: type: number total_category_count: type: number timestamp: type: number required: - bucket_allocation_failures_count - job_id - log_time - memory_status - model_bytes - result_type - total_by_field_count - total_over_field_count - total_partition_field_count - categorization_status - categorized_doc_count - dead_category_count - failed_category_count - frequent_category_count - rare_category_count - total_category_count _types.aggregations.GeoCentroidAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: count: type: number location: allOf: - $ref: '#/components/schemas/_types.GeoLocation' _types.analysis.ClassicTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - classic max_token_length: type: number required: - type _types.analysis.DelimitedPayloadTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - delimited_payload delimiter: description: Character used to separate tokens from payloads. Defaults to `|`. type: string encoding: description: Data type for the stored payload. allOf: - $ref: '#/components/schemas/_types.analysis.DelimitedPayloadEncoding' required: - type _types.aggregations.SamplerAggregationExecutionHint: type: string enum: - map - global_ordinals - bytes_hash _types.NodeId: type: string _types.GeoHash: type: string ml._types.CategorizationStatus: type: string enum: - ok - warn _types.TextEmbedding: type: object properties: model_id: description: 'Model ID is required for all dense_vector fields but may be inferred for semantic_text fields' x-state: Generally available; Added in 8.18.0 type: string model_text: type: string required: - model_text _types.RelationName: type: string ml._types.Page: type: object properties: from: description: Skips the specified number of items. default: 0.0 type: number size: description: Specifies the maximum number of items to obtain. default: 10000.0 type: number _types.aggregations.BucketsQueryContainer: description: 'Aggregation buckets. By default they are returned as an array, but if the aggregation has keys configured for the different buckets, the result is a dictionary.' oneOf: - type: object additionalProperties: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' ml._types.Influence: type: object properties: influencer_field_name: type: string influencer_field_values: type: array items: type: string required: - influencer_field_name - influencer_field_values _types.aggregations.CardinalityAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.MetricAggregationBase' - type: object properties: precision_threshold: description: 'A unique count below which counts are expected to be close to accurate. This allows to trade memory for accuracy.' default: 3000.0 type: number rehash: type: boolean execution_hint: description: "Mechanism by which cardinality aggregations is run.\n\nSupported values include:\n - `global_ordinals`: Run the aggregation by using global ordinals of the field and resolving those values after finishing a shard.\n - `segment_ordinals`: Run the aggregation by using segment ordinal values and resolving those values after each segment.\n - `direct`: Run the aggregation by using field values directly.\n - `save_memory_heuristic`: Heuristic-based mode, default in Elasticsearch 8.3 and earlier.\n - `save_time_heuristic`: Heuristic-based mode, default in Elasticsearch 8.4 and later.\n\n" allOf: - $ref: '#/components/schemas/_types.aggregations.CardinalityExecutionMode' _types.aggregations.FrequentItemSetsField: type: object properties: field: allOf: - $ref: '#/components/schemas/_types.Field' exclude: description: 'Values to exclude. Can be regular expression strings or arrays of strings of exact terms.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsExclude' include: description: 'Values to include. Can be regular expression strings or arrays of strings of exact terms.' allOf: - $ref: '#/components/schemas/_types.aggregations.TermsInclude' required: - field _types.aggregations.IpPrefixAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: The IP address field to aggregation on. The field mapping type must be `ip`. allOf: - $ref: '#/components/schemas/_types.Field' prefix_length: description: 'Length of the network prefix. For IPv4 addresses the accepted range is [0, 32]. For IPv6 addresses the accepted range is [0, 128].' type: number is_ipv6: description: Defines whether the prefix applies to IPv6 addresses. default: false type: boolean append_prefix_length: description: Defines whether the prefix length is appended to IP address keys in the response. default: false type: boolean keyed: description: Defines whether buckets are returned as a hash rather than an array in the response. type: boolean min_doc_count: description: Minimum number of documents in a bucket for it to be included in the response. default: 1.0 type: number required: - field - prefix_length _types.analysis.HindiNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - hindi_normalization required: - type _types.query_dsl.IntervalsMatch: type: object properties: analyzer: description: Analyzer used to analyze terms in the query. type: string max_gaps: description: 'Maximum number of positions between the matching terms. Terms further apart than this are not considered matches.' default: -1.0 type: number ordered: description: If `true`, matching terms must appear in their specified order. default: false type: boolean query: description: Text you wish to find in the provided field. type: string use_field: description: 'If specified, match intervals from this field rather than the top-level field. The `term` is normalized using the search analyzer from this field, unless `analyzer` is specified separately.' allOf: - $ref: '#/components/schemas/_types.Field' filter: description: An optional interval filter. allOf: - $ref: '#/components/schemas/_types.query_dsl.IntervalsFilter' required: - query _types.Distance: type: string _global.search._types.SearchRequestBody: type: object properties: aggregations: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/aggregations description: Defines the aggregations that are run as part of the search request. type: object additionalProperties: $ref: '#/components/schemas/_types.aggregations.AggregationContainer' collapse: description: Collapses search results the values of the specified field. allOf: - $ref: '#/components/schemas/_global.search._types.FieldCollapse' explain: description: If `true`, the request returns detailed information about score computation as part of a hit. default: false type: boolean ext: description: Configuration of search extensions defined by Elasticsearch plugins. type: object additionalProperties: type: object from: description: 'The starting document offset, which must be non-negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` parameter.' default: 0.0 type: number highlight: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/highlighting description: Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results. allOf: - $ref: '#/components/schemas/_global.search._types.Highlight' track_total_hits: description: 'Number of hits matching the query to count accurately. If `true`, the exact number of hits is returned at the cost of some performance. If `false`, the response does not include the total number of hits matching the query.' default: '10000' allOf: - $ref: '#/components/schemas/_global.search._types.TrackHits' indices_boost: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl#relevance-scores description: 'Boost the `_score` of documents from specified indices. The boost value is the factor by which scores are multiplied. A boost value greater than `1.0` increases the score. A boost value between `0` and `1.0` decreases the score.' type: array items: type: object additionalProperties: type: number minProperties: 1 maxProperties: 1 docvalue_fields: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#docvalue-fields description: 'An array of wildcard (`*`) field patterns. The request returns doc values for field names matching these patterns in the `hits.fields` property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' knn: externalDocs: url: https://www.elastic.co/docs/solutions/search/vector/knn#approximate-knn description: The approximate kNN search to run. x-state: Generally available; Added in 8.4.0 oneOf: - $ref: '#/components/schemas/_types.KnnSearch' - type: array items: $ref: '#/components/schemas/_types.KnnSearch' rank: description: The Reciprocal Rank Fusion (RRF) to use. x-state: Generally available; Added in 8.8.0 allOf: - $ref: '#/components/schemas/_types.RankContainer' min_score: description: 'The minimum `_score` for matching documents. Documents with a lower `_score` are not included in search results or results collected by aggregations.' type: number post_filter: description: 'Use the `post_filter` parameter to filter search results. The search hits are filtered after the aggregations are calculated. A post filter has no impact on the aggregation results.' allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' profile: description: 'Set to `true` to return detailed timing information about the execution of individual components in a search request. NOTE: This is a debugging tool and adds significant overhead to search execution.' default: false type: boolean query: externalDocs: url: https://www.elastic.co/docs/explore-analyze/query-filter/languages/querydsl description: The search definition using the Query DSL. allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' rescore: description: Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the `query` and `post_filter` phases. oneOf: - $ref: '#/components/schemas/_global.search._types.Rescore' - type: array items: $ref: '#/components/schemas/_global.search._types.Rescore' retriever: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrievers description: 'A retriever is a specification to describe top documents returned from a search. A retriever replaces other elements of the search API that also return top documents such as `query` and `knn`.' x-state: Generally available; Added in 8.14.0 allOf: - $ref: '#/components/schemas/_types.RetrieverContainer' script_fields: description: Retrieve a script evaluation (based on different fields) for each hit. type: object additionalProperties: $ref: '#/components/schemas/_types.ScriptField' search_after: description: Used to retrieve the next page of hits using a set of sort values from the previous page. allOf: - $ref: '#/components/schemas/_types.SortResults' size: description: 'The number of hits to return, which must not be negative. By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters. To page through more hits, use the `search_after` property.' default: 10.0 type: number slice: description: Split a scrolled search into multiple slices that can be consumed independently. allOf: - $ref: '#/components/schemas/_types.SlicedScroll' sort: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/sort-search-results description: A comma-separated list of : pairs. allOf: - $ref: '#/components/schemas/_types.Sort' _source: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#source-filtering description: 'The source fields that are returned for matching documents. These fields are returned in the `hits._source` property of the search response. If the `stored_fields` property is specified, the `_source` property defaults to `false`. Otherwise, it defaults to `true`.' allOf: - $ref: '#/components/schemas/_global.search._types.SourceConfig' fields: description: 'An array of wildcard (`*`) field patterns. The request returns values for field names matching these patterns in the `hits.fields` property of the response.' type: array items: $ref: '#/components/schemas/_types.query_dsl.FieldAndFormat' suggest: description: Defines a suggester that provides similar looking terms based on a provided text. allOf: - $ref: '#/components/schemas/_global.search._types.Suggester' terminate_after: description: 'The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting. IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers. If set to `0` (default), the query does not terminate early.' default: 0.0 type: number timeout: description: 'The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.' type: string track_scores: description: If `true`, calculate and return document scores, even if the scores are not used for sorting. default: false type: boolean version: description: If `true`, the request returns the document version as part of a hit. default: false type: boolean seq_no_primary_term: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/optimistic-concurrency-control description: If `true`, the request returns sequence number and primary term of the last modification of each hit. type: boolean stored_fields: externalDocs: url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/retrieve-selected-fields#stored-fields description: 'A comma-separated list of stored fields to return as part of a hit. If no fields are specified, no stored fields are included in the response. If this field is specified, the `_source` property defaults to `false`. You can pass `_source: true` to return both source fields and stored fields in the search response.' allOf: - $ref: '#/components/schemas/_types.Fields' pit: description: 'Limit the search to a point in time (PIT). If you provide a PIT, you cannot specify an `` in the request path.' allOf: - $ref: '#/components/schemas/_global.search._types.PointInTimeReference' runtime_mappings: externalDocs: url: https://www.elastic.co/docs/manage-data/data-store/mapping/define-runtime-fields-in-search-request description: 'One or more runtime fields in the search request. These fields take precedence over mapped fields with the same name.' allOf: - $ref: '#/components/schemas/_types.mapping.RuntimeFields' stats: description: 'The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.' type: array items: type: string _types.analysis.BrazilianStemTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - brazilian_stem required: - type _types.Indices: oneOf: - $ref: '#/components/schemas/_types.IndexName' - type: array items: $ref: '#/components/schemas/_types.IndexName' ml._types.AnomalyCause: type: object properties: actual: type: array items: type: number by_field_name: allOf: - $ref: '#/components/schemas/_types.Name' by_field_value: type: string correlated_by_field_value: type: string field_name: allOf: - $ref: '#/components/schemas/_types.Field' function: type: string function_description: type: string geo_results: allOf: - $ref: '#/components/schemas/ml._types.GeoResults' influencers: type: array items: $ref: '#/components/schemas/ml._types.Influence' over_field_name: allOf: - $ref: '#/components/schemas/_types.Name' over_field_value: type: string partition_field_name: type: string partition_field_value: type: string probability: type: number typical: type: array items: type: number required: - probability _types.analysis.WordDelimiterTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.WordDelimiterTokenFilterBase' - type: object properties: type: type: string enum: - word_delimiter required: - type _types.analysis.KeepTypesTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - keep_types mode: description: Indicates whether to keep or remove the specified token types. allOf: - $ref: '#/components/schemas/_types.analysis.KeepTypesMode' types: description: List of token types to keep or remove. type: array items: type: string required: - type - types _types.aggregations.GeohexGridAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: field: description: 'Field containing indexed `geo_point` or `geo_shape` values. If the field contains an array, `geohex_grid` aggregates all array values.' allOf: - $ref: '#/components/schemas/_types.Field' precision: description: 'Integer zoom of the key used to defined cells or buckets in the results. Value should be between 0-15.' default: 6.0 type: number bounds: description: Bounding box used to filter the geo-points in each bucket. allOf: - $ref: '#/components/schemas/_types.GeoBounds' size: description: Maximum number of buckets to return. default: 10000.0 type: number shard_size: description: Number of buckets returned from each shard. type: number required: - field _types.query_dsl.SpanTermQuery: allOf: - $ref: '#/components/schemas/_types.query_dsl.QueryBase' - type: object properties: value: allOf: - $ref: '#/components/schemas/_types.FieldValue' required: - value ml._types.FilterType: type: string enum: - include - exclude _global.search._types.TrackHits: description: 'Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.' oneOf: - type: boolean - type: number _types.KnnSearch: type: object properties: field: description: The name of the vector field to search against allOf: - $ref: '#/components/schemas/_types.Field' query_vector: description: The query vector allOf: - $ref: '#/components/schemas/_types.QueryVector' query_vector_builder: description: The query vector builder. You must provide a query_vector_builder or query_vector, but not both. allOf: - $ref: '#/components/schemas/_types.QueryVectorBuilder' k: description: The final number of nearest neighbors to return as top hits type: number num_candidates: description: The number of nearest neighbor candidates to consider per shard type: number visit_percentage: description: The percentage of vectors to explore per shard while doing knn search with bbq_disk x-state: Generally available; Added in 9.2.0 type: number boost: description: Boost value to apply to kNN scores type: number filter: description: Filters for the kNN search query oneOf: - $ref: '#/components/schemas/_types.query_dsl.QueryContainer' - type: array items: $ref: '#/components/schemas/_types.query_dsl.QueryContainer' similarity: description: The minimum similarity for a vector to be considered a match type: number inner_hits: description: If defined, each search hit will contain inner hits. allOf: - $ref: '#/components/schemas/_global.search._types.InnerHits' rescore_vector: description: Apply oversampling and rescoring to quantized vectors x-state: Generally available; Added in 8.18.0 allOf: - $ref: '#/components/schemas/_types.RescoreVector' _name: type: string required: - field _types.aggregations.ParentAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: type: description: The child type that should be selected. allOf: - $ref: '#/components/schemas/_types.RelationName' _types.analysis.LetterTokenizer: allOf: - $ref: '#/components/schemas/_types.analysis.TokenizerBase' - type: object properties: type: type: string enum: - letter required: - type _types.aggregations.ChildrenAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: type: description: The child type that should be selected. allOf: - $ref: '#/components/schemas/_types.RelationName' _types.analysis.GermanNormalizationTokenFilter: allOf: - $ref: '#/components/schemas/_types.analysis.TokenFilterBase' - type: object properties: type: type: string enum: - german_normalization required: - type _types.ScriptField: type: object properties: script: allOf: - $ref: '#/components/schemas/_types.Script' ignore_failure: type: boolean required: - script _types.aggregations.GeoDistanceAggregation: allOf: - $ref: '#/components/schemas/_types.aggregations.BucketAggregationBase' - type: object properties: distance_type: description: "The distance calculation type.\n\nSupported values include:\n - `arc`: The `arc` calculation is the most accurate.\n - `plane`: The `plane` calculation is faster but less accurate.\n\n" default: arc allOf: - $ref: '#/components/schemas/_types.GeoDistanceType' field: description: A field of type `geo_point` used to evaluate the distance. allOf: - $ref: '#/components/schemas/_types.Field' origin: description: The origin used to evaluate the distance. allOf: - $ref: '#/components/schemas/_types.GeoLocation' ranges: description: An array of ranges used to bucket documents. type: array items: $ref: '#/components/schemas/_types.aggregations.AggregationRange' unit: description: The distance unit. default: m allOf: - $ref: '#/components/schemas/_types.DistanceUnit' _types.aggregations.ExtendedBoundsdouble: type: object properties: max: description: Maximum value for the bound. type: number min: description: Minimum value for the bound. type: number securitySchemes: apiKeyAuth: type: apiKey in: header name: Authorization description: "Elasticsearch APIs support key-based authentication.\nYou must create an API key and use the encoded value in the request header.\nFor example:\n\n```\ncurl -X GET \"${ES_URL}/_cat/indices?v=true\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nTo get API keys, use the `/_security/api_key` APIs." basicAuth: type: http scheme: basic bearerAuth: type: http scheme: bearer description: 'Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API. For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)' x-tagGroups: - name: AI & Machine Learning tags: - analytics - graph - inference - ml - ml anomaly - ml data frame - ml trained model - query_rules - text_structure - name: Cluster Management tags: - ccr - cluster - connector - data stream - ilm - indices - rollup - script - search_application - searchable_snapshots - slm - snapshot - name: Data Processing tags: - enrich - fleet - ingest - logstash - synonyms - transform - name: Information & Monitoring tags: - cat - features - health_report - info - license - migration - tasks - watcher - xpack - name: Search & Document APIs tags: - document - eql - esql - search - sql - name: Security tags: - security