ml_api_demo.sh

#!/bin/bash

HOST='localhost'
PORT=9200
#CURL_AUTH="-u elastic:changeme"
JOB_ID="asamplejob"
ROOT="http://${HOST}:${PORT}/_xpack/ml"
JOBS="${ROOT}/anomaly_detectors"
DATAFEEDS="${ROOT}/datafeeds"


printf "\n== Script started for... $JOBS/$JOB_ID"

printf "\n\n== Stopping datafeed... "
curl $CURL_AUTH -s -X POST ${DATAFEEDS}/datafeed-${JOB_ID}/_stop

printf "\n\n== Deleting datafeed... "
curl $CURL_AUTH -s -X DELETE ${DATAFEEDS}/datafeed-${JOB_ID}

printf "\n\n== Closing job... "
curl $CURL_AUTH -s -X POST ${JOBS}/${JOB_ID}/_close

printf "\n\n== Deleting job... "
curl $CURL_AUTH -s -X DELETE ${JOBS}/${JOB_ID}

printf "\n\n== Creating job... \n"
curl $CURL_AUTH -s -X PUT -H 'Content-Type: application/json' ${JOBS}/${JOB_ID}?pretty -d '{
    "description" : "Unusual responsetimes by airlines",
    "analysis_config" : {
        "bucket_span": "5m",
        "detectors" :[{"function":"metric", "field_name":"responsetime","by_field_name":"airline"}],
        "influencers" : [ "airline" ]
    },
    "data_description": {
      "time_field": "@timestamp"
    }
}'

printf "\n\n== Creating datafeed... \n"
curl $CURL_AUTH -s -X PUT -H 'Content-Type: application/json' ${DATAFEEDS}/datafeed-${JOB_ID}?pretty -d '{
      "job_id" : "'"$JOB_ID"'",
      "indexes" : [
        "farequote-*"
      ],
      "types" : [
        "responsetime"
      ],
      "scroll_size" : 1000
}'


printf "\n\n== Opening job for ${JOB_ID}... "
curl $CURL_AUTH -X POST ${JOBS}/${JOB_ID}/_open

printf "\n\n== Starting datafeed-${JOB_ID}... "
curl $CURL_AUTH -X POST "${DATAFEEDS}/datafeed-${JOB_ID}/_start?start=1970-01-02T10:00:00Z&end=2018-01-01T00:00:00Z"

printf "\n\n== Waiting for job to run  ==\n\n"
     while [  `curl -s -X GET "${JOBS}/${JOB_ID}/_stats?pretty" | grep state | cut -d: -f2 | sed 's/^[ \t]*//;s/[ \t]*$//' | sed 's/"//g'` != "closed" ]; do
         printf "."
         sleep 1
     done
printf "done\n"


printf "\n\n== Top Bucket Anomalies (over a score of 90)  ==\n\n"
curl $CURL_AUTH -X POST "${JOBS}/${JOB_ID}/results/buckets?pretty&anomaly_score=90"

Output:

> ./ml_api_demo.sh

== Script started for... http://localhost:9200/_xpack/ml/anomaly_detectors/asamplejob

== Stopping datafeed... {"stopped":true}

== Deleting datafeed... {"acknowledged":true}

== Closing job... {"closed":true}

== Deleting job... {"acknowledged":true}

== Creating job...
{
  "job_id" : "asamplejob",
  "job_type" : "anomaly_detector",
  "job_version" : "6.4.0",
  "description" : "Unusual responsetimes by airlines",
  "create_time" : 1537534799115,
  "analysis_config" : {
    "bucket_span" : "5m",
    "detectors" : [
      {
        "detector_description" : "metric(responsetime) by airline",
        "function" : "metric",
        "field_name" : "responsetime",
        "by_field_name" : "airline",
        "detector_index" : 0
      }
    ],
    "influencers" : [
      "airline"
    ]
  },
  "analysis_limits" : {
    "model_memory_limit" : "1024mb",
    "categorization_examples_limit" : 4
  },
  "data_description" : {
    "time_field" : "@timestamp",
    "time_format" : "epoch_ms"
  },
  "model_snapshot_retention_days" : 1,
  "results_index_name" : "shared"
}


== Creating datafeed...
{
  "datafeed_id" : "datafeed-asamplejob",
  "job_id" : "asamplejob",
  "query_delay" : "77633ms",
  "indices" : [
    "farequote-*"
  ],
  "types" : [
    "responsetime"
  ],
  "query" : {
    "match_all" : {
      "boost" : 1.0
    }
  },
  "scroll_size" : 1000,
  "chunking_config" : {
    "mode" : "auto"
  }
}


== Opening job for asamplejob... {"opened":true}

== Starting datafeed-asamplejob... {"started":true}

== Waiting for job to run  ==

..........done


== Top Bucket Anomalies (over a score of 90)  ==

{
  "count" : 1,
  "buckets" : [
    {
      "job_id" : "asamplejob",
      "timestamp" : 1486656600000,
      "anomaly_score" : 90.69997,
      "bucket_span" : 300,
      "initial_anomaly_score" : 85.06428380283512,
      "event_count" : 98,
      "is_interim" : false,
      "bucket_influencers" : [
        {
          "job_id" : "asamplejob",
          "result_type" : "bucket_influencer",
          "influencer_field_name" : "airline",
          "initial_anomaly_score" : 85.0642838028127,
          "anomaly_score" : 90.69997,
          "raw_anomaly_score" : 42.534763506999724,
          "probability" : 1.0190164561573176E-43,
          "timestamp" : 1486656600000,
          "bucket_span" : 300,
          "is_interim" : false
        },
        {
          "job_id" : "asamplejob",
          "result_type" : "bucket_influencer",
          "influencer_field_name" : "bucket_time",
          "initial_anomaly_score" : 85.06428380283512,
          "anomaly_score" : 90.69997,
          "raw_anomaly_score" : 41.88368315212244,
          "probability" : 4.162933657755954E-43,
          "timestamp" : 1486656600000,
          "bucket_span" : 300,
          "is_interim" : false
        }
      ],
      "processing_time_ms" : 6,
      "result_type" : "bucket"
    }
  ]
}