OPopenobserve
Anomaly Detection

Update an existing anomaly detection configuration

put/api/{org_id}/anomaly_detection/{config_id}

Request

Path parameters

org_idstring required

Organization identifier

config_idstring required

Anomaly config identifier

Request body

alert_budget_per_daynumber double nullable

Double-option like priority: None leaves the stored budget, Some(None) clears it (back to the trained k), Some(Some(b)) sets it. A plain Option could never clear.

alert_destinationsstring[] nullable
alert_directionstring nullable

both, above or below; null clears to both.

alert_enabledboolean nullable
alert_window_bucketsinteger nullable

Window-share length in buckets, at least 1 and at most 24h of buckets; null clears to 1.

alert_window_fire_pctnumber double nullable

Percent of the window out of band that fires; null clears to 100.

alert_window_recover_pctnumber double nullable

Out-of-band percent below which the window recovers; null clears to the fire percent.

band_widthnumber double nullable

Double-option like the budget: null clears back to the trained k.

custom_sqlstring nullable
descriptionstring nullable
detection_functionstring nullable
detection_function_fieldstring nullable
detection_window_secondsinteger nullable

At most 100,000 histogram buckets; a stored row over the limit runs clamped to it.

enabledboolean nullable
filtersunknown
folder_idstring nullable
histogram_intervalstring nullable
level_half_width_secondsinteger nullable

Accepted and stored, but ignored by the band model.

namestring nullable
ownerstring nullable
percentilenumber double nullable

Legacy, read back as threshold for read-modify-write; k trains at p99, within 3 to 6.

priorityinteger nullable

Double-option so "absent" and "explicit null" stay distinguishable (same shape as TimedAnnotationUpdate::end_time):

  • None — field not supplied, leave the stored value
  • Some(None) — clear the priority
  • Some(Some(p)) — set it

A plain Option cannot express "clear", which made priority the only field on an anomaly config that could be set but never unset — and inconsistent with alerts, where clearing works.

query_modestring nullable
retrain_interval_daysinteger nullable
schedule_intervalstring nullable

At least 1 minute; a stored row below it runs every minute.

tagsstring[] nullable

None leaves stored tags untouched; Some(vec![]) clears them.

templatestring nullable

Absent leaves the stored override; null or "" clears it.

training_window_daysinteger nullable

At most 3,000,000 histogram buckets; a stored row over the limit trains clamped to it.

Example request

{
  "priority": 3
}

Response

Success

AnomalyConfigResponse required

Changes

No recorded changes to this operation across all 1 revision of this API.