At the highest level of abstraction are the results at the bucket level. Essentially, this is the aggregated results for the entire job as a function of time and essentially answers the question "how unusual was this bucket of time?" To understand the structure and content of bucket-level results, let's query the results for a particular ML job. We will start by looking at the results for a simple, single metric job that has no defined influencers:
GET .ml-anomalies-*/_search{ "query": { "bool": { "filter": [ { "range" : { "timestamp" : { "gte": "now-2y" } } }, { "term" : { "job_id" : "farequote_single" } }, { "term" : { "result_type" : "bucket" } }, { "range" : { "anomaly_score" : {"gte" : "90"}}} ] } }}
Here, the query is ...
