Revert to a snapshot Generally available; Added in 5.4.0

POST /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_revert
Api key auth Basic auth Bearer auth

The machine learning features react quickly to anomalous input, learning new behaviors in data. Highly anomalous input increases the variance in the models whilst the system learns whether this is a new step-change in behavior or a one-off event. In the case where this anomalous input is known to be a one-off, then it might be appropriate to reset the model state to a time before this event. For example, you might consider reverting to a saved snapshot after Black Friday or a critical system failure.

Required authorization

  • Cluster privileges: manage_ml

Path parameters

  • job_id string Required

    Identifier for the anomaly detection job.

  • snapshot_id string Required

    You can specify empty as the . Reverting to the empty snapshot means the anomaly detection job starts learning a new model from scratch when it is started.

Query parameters

  • delete_intervening_results boolean

    If true, deletes the results in the time period between the latest results and the time of the reverted snapshot. It also resets the model to accept records for this time period. If you choose not to delete intervening results when reverting a snapshot, the job will not accept input data that is older than the current time. If you want to resend data, then delete the intervening results.

application/json

Body

  • delete_intervening_results boolean

    Refer to the description for the delete_intervening_results query parameter.

Responses

  • 200 application/json
    Hide response attribute Show response attribute object
    • model object Required
      Hide model attributes Show model attributes object
      • description string

        An optional description of the job.

      • job_id string Required
      • latest_record_time_stamp number

        The timestamp of the latest processed record.

      • latest_result_time_stamp number

        The timestamp of the latest bucket result.

      • min_version string Required
      • model_size_stats object
        Hide model_size_stats attributes Show model_size_stats attributes object
        • bucket_allocation_failures_count number Required
        • job_id string Required

        • log_time string | number Required

          A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

          One of:
          DateTime string UnitMillis number

          Time unit for milliseconds

        • memory_status string Required

          Values are ok, soft_limit, or hard_limit.

        • model_bytes number | string Required

          One of:
          ByteSize number ByteSize string

        • model_bytes_exceeded number | string

          One of:
          ByteSize number ByteSize string

        • model_bytes_memory_limit number | string

          One of:
          ByteSize number ByteSize string

        • output_memory_allocator_bytes number | string

          One of:
          ByteSize number ByteSize string

        • peak_model_bytes number | string

          One of:
          ByteSize number ByteSize string
        • assignment_memory_basis string
        • result_type string Required
        • total_by_field_count number Required
        • total_over_field_count number Required
        • total_partition_field_count number Required
        • categorization_status string Required

          Values are ok or warn.

        • categorized_doc_count number Required
        • dead_category_count number Required
        • failed_category_count number Required
        • frequent_category_count number Required
        • rare_category_count number Required
        • total_category_count number Required
        • timestamp number
      • retain boolean Required

        If true, this snapshot will not be deleted during automatic cleanup of snapshots older than model_snapshot_retention_days. However, this snapshot will be deleted when the job is deleted. The default value is false.

      • snapshot_doc_count number Required

        For internal use only.

      • snapshot_id string Required
      • timestamp number Required

        The creation timestamp for the snapshot.
POST /_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_revert 
curl \
 --request POST 'http://api.example.com/_ml/anomaly_detectors/{job_id}/model_snapshots/{snapshot_id}/_revert' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"delete_intervening_results\": true\n}"'
Request example
An example body for a `POST _ml/anomaly_detectors/low_request_rate/model_snapshots/1637092688/_revert` request. 
{
  "delete_intervening_results": true
}