Estimate anomaly detection jobs model memory API

Makes an estimation of the memory usage for an anomaly detection job model. It is based on analysis configuration details for the job and cardinality estimates for the fields it references.

Request

POST _ml/anomaly_detectors/_estimate_model_memory

Prerequisites

If the Elasticsearch security features are enabled, you must have the following privileges:

  • manage_ml or cluster: manage

For more information, see Security privileges and Machine learning security privileges.

Request body

analysis_config

(Required, object) For a list of the properties that you can specify in the analysis_config component of the body of this API, see analysis_config.

max_bucket_cardinality

(Required*, object) Estimates of the highest cardinality in a single bucket that is observed for influencer fields over the time period that the job analyzes data. To produce a good answer, values must be provided for all influencer fields. Providing values for fields that are not listed as influencers has no effect on the estimation.
*It can be omitted from the request if there are no influencers.

overall_cardinality

(Required*, object) Estimates of the cardinality that is observed for fields over the whole time period that the job analyzes data. To produce a good answer, values must be provided for fields referenced in the by_field_name, over_field_name and partition_field_name of any detectors. Providing values for other fields has no effect on the estimation.
*It can be omitted from the request if no detectors have a by_field_name, over_field_name or partition_field_name.

Examples

  1. POST _ml/anomaly_detectors/_estimate_model_memory
  2. {
  3.   "analysis_config": {
  4.     "bucket_span": "5m",
  5.     "detectors": [
  6.       {
  7.         "function": "sum",
  8.         "field_name": "bytes",
  9.         "by_field_name": "status",
  10.         "partition_field_name": "app"
  11.       }
  12.     ],
  13.     "influencers": [ "source_ip", "dest_ip" ]
  14.   },
  15.   "overall_cardinality": {
  16.     "status": 10,
  17.     "app": 50
  18.   },
  19.   "max_bucket_cardinality": {
  20.     "source_ip": 300,
  21.     "dest_ip": 30
  22.   }
  23. }

The estimate returns the following result:

  1. {
  2.   "model_memory_estimate": "21mb"
  3. }