elasticsearch/docs/reference/ml/anomaly-detection/stopping-ml.asciidoc

[role="xpack"]
[[stopping-ml]]
== Stopping {ml} {anomaly-detect}

An orderly shutdown ensures that:

* {dfeeds-cap} are stopped
* Buffers are flushed
* Model history is pruned
* Final results are calculated
* Model snapshots are saved
* {anomaly-jobs-cap} are closed

This process ensures that jobs are in a consistent state in case you want to
subsequently re-open them.

[float]
[[stopping-ml-datafeeds]]
=== Stopping {dfeeds}

When you stop a {dfeed}, it ceases to retrieve data from {es}. You can stop a
{dfeed} by using {kib} or the
{ref}/ml-stop-datafeed.html[stop {dfeeds} API]. For example, the following
request stops the `feed1` {dfeed}:

[source,js]
--------------------------------------------------
POST _ml/datafeeds/feed1/_stop
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:server_metrics_startdf]

NOTE: You must have `manage_ml`, or `manage` cluster privileges to stop {dfeeds}.
For more information, see <<security-privileges>>.

A {dfeed} can be started and stopped multiple times throughout its lifecycle.

//For examples of stopping {dfeeds} in {kib}, see <<ml-gs-job1-manage>>.

[float]
[[stopping-all-ml-datafeeds]]
==== Stopping all {dfeeds}

If you are upgrading your cluster, you can use the following request to stop all
{dfeeds}:

[source,js]
----------------------------------
POST _ml/datafeeds/_all/_stop
----------------------------------
// CONSOLE
// TEST[skip:needs-licence]

[float]
[[closing-ml-jobs]]
=== Closing {anomaly-jobs}

When you close an {anomaly-job}, it cannot receive data or perform analysis
operations. If a job is associated with a {dfeed}, you must stop the {dfeed}
before you can close the job. If the {dfeed} has an end date, the job closes
automatically on that end date.

You can close a job by using the
{ref}/ml-close-job.html[close {anomaly-job} API]. For 
example, the following request closes the `job1` job:

[source,js]
--------------------------------------------------
POST _ml/anomaly_detectors/job1/_close
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:server_metrics_openjob]

NOTE: You must have `manage_ml`, or `manage` cluster privileges to stop {dfeeds}.
For more information, see <<security-privileges>>.

{anomaly-jobs-cap} can be opened and closed multiple times throughout their
lifecycle.

[float]
[[closing-all-ml-datafeeds]]
==== Closing all {anomaly-jobs}

If you are upgrading your cluster, you can use the following request to close
all open {anomaly-jobs} on the cluster:

[source,js]
----------------------------------
POST _ml/anomaly_detectors/_all/_close
----------------------------------
// CONSOLE
// TEST[skip:needs-licence]