Execute Algorithm API
Some algorithms, such as Localization, don’t require trained models. You can run no-model-based algorithms using the execute API.
Endpoints
POST _plugins/_ml/_execute/<algorithm_name> Example request: Execute localization
The following example uses the Localization algorithm to find subset-level information for aggregate data (for example, aggregated over time) that demonstrates the activity of interest, such as spikes, drops, changes, or anomalies.
POST /_plugins/_ml/_execute/anomaly_localization { "index_name": "rca-index", "attribute_field_names": [ "attribute" ], "aggregations": [ { "sum": { "sum": { "field": "value" } } } ], "time_field_name": "timestamp", "start_time": 1620630000000, "end_time": 1621234800000, "min_time_interval": 86400000, "num_outputs": 10 } Example response
{ "results" : [ { "name" : "sum", "result" : { "buckets" : [ { "start_time" : 1620630000000, "end_time" : 1620716400000, "overall_aggregate_value" : 65.0 }, { "start_time" : 1620716400000, "end_time" : 1620802800000, "overall_aggregate_value" : 75.0, "entities" : [ { "key" : [ "attr0" ], "contribution_value" : 1.0, "base_value" : 2.0, "new_value" : 3.0 }, { "key" : [ "attr1" ], "contribution_value" : 1.0, "base_value" : 3.0, "new_value" : 4.0 }, { "key" : [ "attr2" ], "contribution_value" : 1.0, "base_value" : 4.0, "new_value" : 5.0 }, { "key" : [ "attr3" ], "contribution_value" : 1.0, "base_value" : 5.0, "new_value" : 6.0 }, { "key" : [ "attr4" ], "contribution_value" : 1.0, "base_value" : 6.0, "new_value" : 7.0 }, { "key" : [ "attr5" ], "contribution_value" : 1.0, "base_value" : 7.0, "new_value" : 8.0 }, { "key" : [ "attr6" ], "contribution_value" : 1.0, "base_value" : 8.0, "new_value" : 9.0 }, { "key" : [ "attr7" ], "contribution_value" : 1.0, "base_value" : 9.0, "new_value" : 10.0 }, { "key" : [ "attr8" ], "contribution_value" : 1.0, "base_value" : 10.0, "new_value" : 11.0 }, { "key" : [ "attr9" ], "contribution_value" : 1.0, "base_value" : 11.0, "new_value" : 12.0 } ] }, ... ] } } ] }