elasticsearch/docs/reference/ml/anomaly-detection/apis/estimate-model-memory.asciidoc

[role="xpack"]
[testenv="platinum"]
[[ml-estimate-model-memory]]
=== Estimate {anomaly-jobs} model memory API
++++
<titleabbrev>Estimate model memory</titleabbrev>
++++

Estimates the model memory an {anomaly-job} is likely to need based on analysis
configuration details and cardinality estimates for the fields it references.

[[ml-estimate-model-memory-request]]
==== {api-request-title}

`POST _ml/anomaly_detectors/_estimate_model_memory`

[[ml-estimate-model-memory-prereqs]]
==== {api-prereq-title}

* If the {es} {security-features} are enabled, you must have `manage_ml` or
`manage` cluster privileges to use this API. See
<<security-privileges>>.

[[ml-estimate-model-memory-request-body]]
==== {api-request-body-title}

`analysis_config`::
(Required, object) For a list of the properties that you can specify in the
`analysis_config` component of the body of this API, see <<put-analysisconfig,`analysis_config`>>.

`max_bucket_cardinality`::
(Required^\*^, object) Estimates of the highest cardinality in a single bucket
that will be observed for influencer fields over the time period that the job
analyzes data. To produce a good answer, values must be provided for
all influencer fields. It does not matter if values are provided for fields
that are not listed as `influencers`. +
^*^If there are no `influencers` then `max_bucket_cardinality` can be omitted 
from the request.

`overall_cardinality`::
(Required^\*^, object) Estimates of the cardinality that will be observed for
fields over the whole time period that the job analyzes data. To produce a good 
answer, values must be provided for fields referenced in the `by_field_name`, 
`over_field_name` and `partition_field_name` of any detectors. It does not 
matter if values are provided for other fields. +
^*^If no detectors have a `by_field_name`, `over_field_name` or 
`partition_field_name` then `overall_cardinality` can be omitted from the 
request.

[[ml-estimate-model-memory-example]]
==== {api-examples-title}

[source,console]
--------------------------------------------------
POST _ml/anomaly_detectors/_estimate_model_memory
{
    "analysis_config": {
        "bucket_span": "5m",
        "detectors": [
          {
            "function": "sum",
            "field_name": "bytes",
            "by_field_name": "status",
            "partition_field_name": "app"
          }
        ],
        "influencers": [ "source_ip", "dest_ip" ]
    },
    "overall_cardinality": {
       "status": 10,
       "app": 50
    },
    "max_bucket_cardinality": {
       "source_ip": 300,
       "dest_ip": 30
    }
}
--------------------------------------------------
// TEST[skip:needs-licence]

The estimate returns the following result:

[source,console-result]
----
{
  "model_memory_estimate": "21mb"
}
----