|
@@ -26,11 +26,11 @@ The {ml-features} include the following count functions:
|
|
|
The `count` function detects anomalies when the number of events in a bucket is
|
|
|
anomalous.
|
|
|
|
|
|
-The `high_count` function detects anomalies when the count of events in a
|
|
|
-bucket are unusually high.
|
|
|
+The `high_count` function detects anomalies when the count of events in a bucket
|
|
|
+are unusually high.
|
|
|
|
|
|
-The `low_count` function detects anomalies when the count of events in a
|
|
|
-bucket are unusually low.
|
|
|
+The `low_count` function detects anomalies when the count of events in a bucket
|
|
|
+are unusually low.
|
|
|
|
|
|
These functions support the following properties:
|
|
|
|
|
@@ -111,8 +111,8 @@ PUT _ml/anomaly_detectors/example3
|
|
|
--------------------------------------------------
|
|
|
// TEST[skip:needs-licence]
|
|
|
|
|
|
-In this example, the function detects when the count of events for a
|
|
|
-status code is lower than usual.
|
|
|
+In this example, the function detects when the count of events for a status code
|
|
|
+is lower than usual.
|
|
|
|
|
|
When you use this function in a detector in your {anomaly-job}, it models the
|
|
|
event rate for each status code and detects when a status code has an unusually
|
|
@@ -168,19 +168,19 @@ For more information about those properties, see the
|
|
|
|
|
|
For example, if you have the following number of events per bucket:
|
|
|
|
|
|
-========================================
|
|
|
+====
|
|
|
|
|
|
1,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,43,31,0,0,0,0,0,0,0,0,0,0,0,0,2,1
|
|
|
|
|
|
-========================================
|
|
|
+====
|
|
|
|
|
|
The `non_zero_count` function models only the following data:
|
|
|
|
|
|
-========================================
|
|
|
+====
|
|
|
|
|
|
1,22,2,43,31,2,1
|
|
|
|
|
|
-========================================
|
|
|
+====
|
|
|
|
|
|
.Example 5: Analyzing signatures with the high_non_zero_count function
|
|
|
[source,console]
|