@@ -26,11 +26,11 @@ The {ml-features} include the following count functions:
The `count` function detects anomalies when the number of events in a bucket is
anomalous.
-The `high_count` function detects anomalies when the count of events in a
-bucket are unusually high.
+The `high_count` function detects anomalies when the count of events in a bucket
+are unusually high.
-The `low_count` function detects anomalies when the count of events in a
-bucket are unusually low.
+The `low_count` function detects anomalies when the count of events in a bucket
+are unusually low.
These functions support the following properties:
@@ -111,8 +111,8 @@ PUT _ml/anomaly_detectors/example3
--------------------------------------------------
// TEST[skip:needs-licence]
-In this example, the function detects when the count of events for a
-status code is lower than usual.
+In this example, the function detects when the count of events for a status code
+is lower than usual.
When you use this function in a detector in your {anomaly-job}, it models the
event rate for each status code and detects when a status code has an unusually
@@ -168,19 +168,19 @@ For more information about those properties, see the
For example, if you have the following number of events per bucket:
-========================================
+====
1,22,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,43,31,0,0,0,0,0,0,0,0,0,0,0,0,2,1
The `non_zero_count` function models only the following data:
1,22,2,43,31,2,1
.Example 5: Analyzing signatures with the high_non_zero_count function
[source,console]