Comments (3)
I had a look through the code. We already support event type correctly in the anomaly detection backend so supporting skip_result
for scheduled events simply requires us to:
- Add a type field to scheduled events (default to
skip_model_update
) - Pass the configured type to the backend rather than hard code to
skip_model_update
. (We already pass these events as detection rules, so this doesn't require us to change the Java to autodetect communication.)
This is relatively low effort and we should do this first.
from elasticsearch.
Pinging @elastic/ml-core (Team:ML)
from elasticsearch.
Currently, we test for time shifts including +/- 1 hr and as soon as we are confident update the model. Unfortunately, in the case of DLS we do not suppress the anomalies whilst this is happening and it takes us some time to be confident there has been a shift.
Some thoughts:
- One issue we have is in older versions of the code base we have no way of saying "update the model but suppress results" using calendar events, as we do for rules. In newer versions we simply down weight the update greatly, but still check for certain events such time shifts (this has different pros and cons). The cleanest approach would be to use the same notion of suppress results or suppress updates for calendar events. This would allow people to cleanly say "I don't care to be told about alerts in this time period, but I would like the model to adapt". This provides a route to be able to configure a better experience for DLS.
- We have some challenges with doing this automatically: i) different time series experience DLS on different dates even for the same job depending where the data came from, ii) some time series experience no DLS, because for example they monitor something using fixed interval scheduling. Whatever we do I don't think we can blindly apply DLS time shift based on a calendar.
A possible enhancement:
Allow users to specify a calendar to use for DLS (i.e. which days to expect it to occur). On the DLS event day we would
- Parameterise our time shift test to make it quicker to apply a +/- 1 hr shift
- Compute anomalies for each time series using shifted (+/- 1hr) and unshifted time series and use the minimum anomaly score for either
[ 3. Try and learn the DLS calendar which applies to the job.]
Point 2 is important since any event which is actually a DLS time shift should then generate no anomalies, but we would not disable detection altogether.
Point 3 is a nice to have which allows for no configuration, but adds additional implementation complexity and does still need some time to learn the calendar, so users would have to accept anomalies on the first few DLS events.
from elasticsearch.
Related Issues (20)
- ES|QL when executed over CCS requires "read" local privilege for any (or none) local indices HOT 4
- [documentation] ES|QL over CCS with API key based security HOT 4
- Logical CCS Names: Dynamically reference additional cluster information HOT 1
- Limit shard snapshot work-in-progress HOT 1
- [ESQL] SimplifyComparisonArithmetics not being correctly applied HOT 1
- [CI] ReactiveStorageDeciderDecisionTests testStoragePreventsAllocation failing HOT 2
- Automatically add created, last_changed and changed_by metadata for index templates, component templates and ingest pipelines HOT 6
- Failures in elasticsearch / periodic / platform-support / 7.17 / windows-2016 / checkPart1 / platform-support-windows HOT 3
- ES|QL version of spatial intersects search slow on some benchmarks HOT 2
- [CI] MlDistributedFailureIT testFullClusterRestart failing HOT 3
- [CI] DataStreamsSnapshotsIT testRestoreSnapshotFully failing with assertion error HOT 1
- [CI] CoordinatorVotingConfigurationTests testClusterUUIDLogging failing HOT 2
- LogsDB index mode feature flag in `logs@settings` HOT 1
- [CI] SSLConfigurationReloaderTests testReloadingKeyStore failing HOT 5
- [CI] Multiple test failures JDK23 on main HOT 2
- [CI] WildcardLikeTests testFold {TestCase= with text} failing HOT 2
- [CI] InferenceIT testInferClassificationModel failing HOT 2
- [CI] WildcardLikeTests testCrankyEvaluateBlockWithNulls {TestCase= with keyword} failing HOT 2
- Large synonyms sets inconsistently return synonym results HOT 4
- Kibana Docker startup does not allow configuration of CCS Monitoring via env vars HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from elasticsearch.