The results index

As we mentioned previously, ML analyzes data and summarizes the results into a results index. By default, this index is called .ml-anomalies-shared, unless the job was configured to use a dedicated index via ticking the box in the configuration user interface (UI) or via setting the results_index_name field when using the API. If that was the case, then the results index will be called .ml-anomalies-custom-myname, where myname is either the declared value of the results_index_name field when using the API, or the name of the job itself when using the UI. In either case, the results index can be quite small compared to the size of data that was used to feed the ML analysis. In addition, an index alias is also created of the .ml-anomalies-jobname form, where jobname is the name of the job. The definition of this alias can be seen by hitting the following API call...