You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/alerts/rule-type-index-threshold.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -80,7 +80,7 @@ The following action variables are specific to the index threshold rule. You can
80
80
81
81
## Example [_example]
82
82
83
-
In this example, you will use the {{kib}} [sample weblog data set](https://www.elastic.co/guide/en/kibana/current/add-sample-data.html) to set up and tune the conditions on an index threshold rule. For this example, you want to detect when any of the top four sites serve more than 420,000 bytes over a 24 hour period.
83
+
In this example, you will use the {{kib}} [sample weblog data set](https://www.elastic.co/guide/en/kibana/current/get-started.html) to set up and tune the conditions on an index threshold rule. For this example, you want to detect when any of the top four sites serve more than 420,000 bytes over a 24 hour period.
84
84
85
85
1. Go to **{{stack-manage-app}} > {{rules-ui}}** and click **Create rule**.
Copy file name to clipboardExpand all lines: explore-analyze/dashboards/building.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,8 +15,8 @@ mapped_pages:
15
15
$$$dashboard-minimum-requirements$$$
16
16
To create or edit dashboards, you first need to:
17
17
18
-
* have [data indexed into {{es}}](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index.html) and a [data view](../find-and-organize/data-views.md). A data view is a subset of your {{es}} data, and allows you to load just the right data when building a visualization or exploring it.
19
-
18
+
* have [data indexed into {{es}}](https://www.elastic.co/guide/en/starting-with-the-elasticsearch-platform-and-its-solutions/current/getting-started-general-purpose.html#gp-gs-add-data) and a [data view](../find-and-organize/data-views.md). A data view is a subset of your {{es}} data, and allows you to load just the right data when building a visualization or exploring it.
19
+
20
20
::::{tip}
21
21
If you don’t have data at hand and still want to explore dashboards, you can import one of the [sample data sets](../../manage-data/ingest/sample-data.md) available.
Copy file name to clipboardExpand all lines: explore-analyze/dashboards/drilldowns.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -76,7 +76,7 @@ Create a drilldown that opens the **Detailed logs** dashboard from the **[Logs]
76
76
77
77
## Create URL drilldowns [create-url-drilldowns]
78
78
79
-
URL drilldowns enable you to navigate from a dashboard to external websites. Destination URLs can be dynamic, depending on the dashboard context or user interaction with a panel. To create URL drilldowns, you add [variables](https://www.elastic.co/guide/en/kibana/current/url-drilldown.html#variables) to a URL template, which configures the behavior of the drilldown. All panels that you create with the visualization editors support dashboard drilldowns.
79
+
URL drilldowns enable you to navigate from a dashboard to external websites. Destination URLs can be dynamic, depending on the dashboard context or user interaction with a panel. To create URL drilldowns, you add [variables](https://www.elastic.co/guide/en/kibana/current/drilldowns.html) to a URL template, which configures the behavior of the drilldown. All panels that you create with the visualization editors support dashboard drilldowns.
80
80
81
81

Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/anomaly-detection-scale.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -111,7 +111,7 @@ When working with large model sizes, consider how frequently you want to create
111
111
112
112
Also consider how long you wish to retain snapshots using `model_snapshot_retention_days` and `daily_model_snapshot_retention_after_days`. Retaining fewer snapshots substantially reduces index storage requirements for model state, but also reduces the granularity of model snapshots from which you can revert.
113
113
114
-
For more information, refer to [Model snapshots](https://www.elastic.co/guide/en/machine-learning/current/ml-model-snapshots.html).
114
+
For more information, refer to [Model snapshots](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-model-snapshots).
115
115
116
116
## 12. Optimize your search queries [search-queries]
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/geographic-anomalies.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,7 @@ To get the best results from {{ml}} analytics, you must understand your data. Yo
34
34
There are a few limitations to consider before you create this type of job:
35
35
36
36
1. You cannot create forecasts for {{anomaly-jobs}} that contain geographic functions.
37
-
2. You cannot add [custom rules with conditions](https://www.elastic.co/guide/en/machine-learning/current/ml-rules.html) to detectors that use geographic functions.
37
+
2. You cannot add [custom rules with conditions](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-rules) to detectors that use geographic functions.
38
38
39
39
If those limitations are acceptable, try creating an {{anomaly-job}} that uses the [`lat_long` function](https://www.elastic.co/guide/en/machine-learning/current/ml-geo-functions.html#ml-lat-long) to analyze your own data or the sample data sets.
40
40
@@ -201,7 +201,7 @@ You can also view the anomaly in **Maps** by clicking **View in Maps** in the ac
201
201
202
202
When you try this type of {{anomaly-job}} with your own data, it might take some experimentation to find the best combination of buckets, detectors, and influencers to detect the type of behavior you’re seeking.
203
203
204
-
For more information about {{anomaly-detect}} concepts, see [Concepts](https://www.elastic.co/guide/en/machine-learning/current/ml-concepts.html). For the full list of functions that you can use in {{anomaly-jobs}}, see [*Function reference*](ml-functions.md). For more {{anomaly-detect}} examples, see [Examples](https://www.elastic.co/guide/en/machine-learning/current/anomaly-examples.html).
204
+
For more information about {{anomaly-detect}} concepts, see [Concepts](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-overview.html). For the full list of functions that you can use in {{anomaly-jobs}}, see [*Function reference*](ml-functions.md). For more {{anomaly-detect}} examples, see [Examples](https://www.elastic.co/guide/en/machine-learning/current/anomaly-how-tos.html).
205
205
206
206
## Add anomaly layers to your maps [geographic-anomalies-map-layer]
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/ml-ad-run-jobs.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -116,7 +116,7 @@ For each {{anomaly-job}}, you can optionally specify a dedicated index to store
116
116
117
117
If you create {{anomaly-jobs}} in {{kib}}, you *must* use {{dfeeds}} to retrieve data from {{es}} for analysis. When you create an {{anomaly-job}}, you select a {{data-source}} and {{kib}} configures the {{dfeed}} for you under the covers.
118
118
119
-
You can associate only one {{dfeed}} with each {{anomaly-job}}. The {{dfeed}} contains a query that runs at a defined interval (`frequency`). By default, this interval is calculated relative to the [bucket span](https://www.elastic.co/guide/en/machine-learning/current/ml-buckets.html) of the {{anomaly-job}}. If you are concerned about delayed data, you can add a delay before the query runs at each interval. See [Handling delayed data](ml-delayed-data-detection.md).
119
+
You can associate only one {{dfeed}} with each {{anomaly-job}}. The {{dfeed}} contains a query that runs at a defined interval (`frequency`). By default, this interval is calculated relative to the [bucket span](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-create-job) of the {{anomaly-job}}. If you are concerned about delayed data, you can add a delay before the query runs at each interval. See [Handling delayed data](ml-delayed-data-detection.md).
120
120
121
121
{{dfeeds-cap}} can also aggregate data before sending it to the {{anomaly-job}}. There are some limitations, however, and aggregations should generally be used only for low cardinality data. See [Aggregating data for faster performance](ml-configuring-aggregation.md).
122
122
@@ -157,7 +157,7 @@ If you want to add multiple scheduled events at once, you can import an iCalenda
157
157
158
158
* You must identify scheduled events before your {{anomaly-job}} analyzes the data for that time period. Machine learning results are not updated retroactively.
159
159
* If your iCalendar file contains recurring events, only the first occurrence is imported.
160
-
*[Bucket results](https://www.elastic.co/guide/en/machine-learning/current/ml-bucket-results.html) are generated during scheduled events but they have an anomaly score of zero.
160
+
*[Bucket results](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-view-results.html#ml-ad-bucket-results) are generated during scheduled events but they have an anomaly score of zero.
161
161
* If you use long or frequent scheduled events, it might take longer for the {{ml}} analytics to learn to model your data and some anomalous behavior might be missed.
162
162
163
163
::::
@@ -192,7 +192,7 @@ You can see the list of model snapshots for each job with the [get model snapsho
192
192
:::
193
193
194
194
::::{tip}
195
-
There are situations other than system failures where you might want to [revert](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-revert-snapshot.html) to using a specific model snapshot. The {{ml-features}} react quickly to anomalous input and new behaviors in data. Highly anomalous input increases the variance in the models and {{ml}} analytics must determine whether it is a new step-change in behavior or a one-off event. In the case where you know this anomalous input is a one-off, it might be appropriate to reset the model state to a time before this event. For example, after a Black Friday sales day you might consider reverting to a saved snapshot. If you know about such events in advance, however, you can use [calendars and scheduled events](https://www.elastic.co/guide/en/machine-learning/current/ml-calendars.html) to avoid impacting your model.
195
+
There are situations other than system failures where you might want to [revert](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-revert-snapshot.html) to using a specific model snapshot. The {{ml-features}} react quickly to anomalous input and new behaviors in data. Highly anomalous input increases the variance in the models and {{ml}} analytics must determine whether it is a new step-change in behavior or a one-off event. In the case where you know this anomalous input is a one-off, it might be appropriate to reset the model state to a time before this event. For example, after a Black Friday sales day you might consider reverting to a saved snapshot. If you know about such events in advance, however, you can use [calendars and scheduled events](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-calendars) to avoid impacting your model.
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/ml-getting-started.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -97,7 +97,7 @@ The job uses *buckets* to divide the time series into batches for processing. Fo
97
97
98
98
Each {{anomaly-job}} contains one or more *detectors*, which define the type of analysis that occurs (for example, `max`, `average`, or `rare` analytical functions) and the fields that are analyzed. Some of the analytical functions look for single anomalous data points. For example, `max` identifies the maximum value that is seen within a bucket. Others perform some aggregation over the length of the bucket. For example, `mean` calculates the mean of all the data points seen within the bucket.
99
99
100
-
For more information, see [{{dfeeds-cap}}](ml-ad-run-jobs.md#ml-ad-datafeeds), [Buckets](https://www.elastic.co/guide/en/machine-learning/current/ml-buckets.html), and [*Function reference*](ml-functions.md).
100
+
For more information, see [{{dfeeds-cap}}](ml-ad-run-jobs.md#ml-ad-datafeeds), [Buckets](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-create-job), and [*Function reference*](ml-functions.md).
101
101
102
102
::::
103
103
@@ -317,7 +317,7 @@ If you’re now thinking about where {{anomaly-detect}} can be most impactful fo
317
317
2. It should be information that contains key performance indicators for the health, security, or success of your business or system. The better you know the data, the quicker you will be able to create jobs that generate useful insights.
318
318
3. Ideally, the data is located in {{es}} and you can therefore create a {{dfeed}} that retrieves data in real time. If your data is outside of {{es}}, you cannot use {{kib}} to create your jobs and you cannot use {{dfeeds}}.
319
319
320
-
In general, it is a good idea to start with single metric {{anomaly-jobs}} for your key performance indicators. After you examine these simple analysis results, you will have a better idea of what the influencers might be. You can create multi-metric jobs and split the data or create more complex analysis functions as necessary. For examples of more complicated configuration options, see [Examples](https://www.elastic.co/guide/en/machine-learning/current/anomaly-examples.html).
320
+
In general, it is a good idea to start with single metric {{anomaly-jobs}} for your key performance indicators. After you examine these simple analysis results, you will have a better idea of what the influencers might be. You can create multi-metric jobs and split the data or create more complex analysis functions as necessary. For examples of more complicated configuration options, see [Examples](https://www.elastic.co/guide/en/machine-learning/current/anomaly-how-tos.html).
321
321
322
322
If you want to find more sample jobs, see [Supplied configurations](ootb-ml-jobs.md). In particular, there are sample jobs for [Apache](https://www.elastic.co/guide/en/machine-learning/current/ootb-ml-jobs-apache.html) and [Nginx](https://www.elastic.co/guide/en/machine-learning/current/ootb-ml-jobs-nginx.html) that are quite similar to the examples in this tutorial.
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/ml-limitations.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -168,7 +168,7 @@ When the aggregation interval of the {{dfeed}} and the bucket span of the job do
168
168
169
169
### Calendars and filters are visible in all {{kib}} spaces [ml-space-limitations]
170
170
171
-
[Spaces](../../../deploy-manage/manage-spaces.md) enable you to organize your {{anomaly-jobs}} in {{kib}} and to see only the jobs and other saved objects that belong to your space. However, this limited scope does not apply to [calendars](https://www.elastic.co/guide/en/machine-learning/current/ml-calendars.html) and [filters](https://www.elastic.co/guide/en/machine-learning/current/ml-rules.html); they are visible in all spaces.
171
+
[Spaces](../../../deploy-manage/manage-spaces.md) enable you to organize your {{anomaly-jobs}} in {{kib}} and to see only the jobs and other saved objects that belong to your space. However, this limited scope does not apply to [calendars](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-calendars) and [filters](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-rules); they are visible in all spaces.
172
172
173
173
### Rollup indices are not supported in {{kib}} [ml-rollup-limitations]
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/move-jobs.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,6 +12,6 @@ The exported file contains configuration details; it does not contain the {{ml}}
12
12
13
13
There are some additional actions that you must take before you can successfully import and run your jobs:
14
14
15
-
1. The {{kib}} [{{data-sources}}](https://www.elastic.co/guide/en/kibana/current/index-patterns.html) that are used by {{anomaly-detect}} {dfeeds} and {{dfanalytics}} source indices must exist; otherwise, the import fails.
15
+
1. The {{kib}} [{{data-sources}}](https://www.elastic.co/guide/en/kibana/current/data-views.html) that are used by {{anomaly-detect}} {dfeeds} and {{dfanalytics}} source indices must exist; otherwise, the import fails.
16
16
2. If your {{anomaly-jobs}} use [custom rules](ml-configuring-detector-custom-rules.md) with filter lists, the filter lists must exist; otherwise, the import fails. To create filter lists, use {{kib}} or the [create filters API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-filter.html).
17
-
3. If your {{anomaly-jobs}} were associated with [calendars](https://www.elastic.co/guide/en/machine-learning/current/ml-calendars.html), you must create the calendar in the new environment and add your imported jobs to the calendar. Use {{kib}} or the [create calendars](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar.html), [add events to calendar](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-post-calendar-event.html), and [add jobs to calendar](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar-job.html) APIs.
17
+
3. If your {{anomaly-jobs}} were associated with [calendars](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-calendars), you must create the calendar in the new environment and add your imported jobs to the calendar. Use {{kib}} or the [create calendars](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar.html), [add events to calendar](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-post-calendar-event.html), and [add jobs to calendar](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-put-calendar-job.html) APIs.
Copy file name to clipboardExpand all lines: explore-analyze/machine-learning/anomaly-detection/ootb-ml-jobs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ mapped_pages:
6
6
7
7
# Supplied configurations [ootb-ml-jobs]
8
8
9
-
{{anomaly-jobs-cap}} contain the configuration information and metadata necessary to perform an analytics task. {{kib}} can recognize certain types of data and provide specialized wizards for that context. This page lists the categories of the {{anomaly-jobs}} that are ready to use via {{kib}} in **Machine learning**. Refer to [Create {{anomaly-jobs}}](https://www.elastic.co/guide/en/machine-learning/current/create-jobs.html) to learn more about creating a job by using supplied configurations. Logs and Metrics supplied configurations are available and can be created via the related solution UI in {{kib}}.
9
+
{{anomaly-jobs-cap}} contain the configuration information and metadata necessary to perform an analytics task. {{kib}} can recognize certain types of data and provide specialized wizards for that context. This page lists the categories of the {{anomaly-jobs}} that are ready to use via {{kib}} in **Machine learning**. Refer to [Create {{anomaly-jobs}}](https://www.elastic.co/guide/en/machine-learning/current/ml-ad-run-jobs.html#ml-ad-create-job) to learn more about creating a job by using supplied configurations. Logs and Metrics supplied configurations are available and can be created via the related solution UI in {{kib}}.
0 commit comments