diff --git a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.md b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.md index dc35e9c11e..1b04ad91f0 100644 --- a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.md +++ b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.md @@ -1,6 +1,7 @@ --- mapped_pages: - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.html + - https://www.elastic.co/guide/en/cloud/current/ec-restore-snapshots-containing-searchable-snapshots-indices-across-clusters.html --- # Restore snapshots containing searchable snapshots indices across clusters [ece-restore-snapshots-containing-searchable-snapshots-indices-across-clusters] @@ -22,7 +23,7 @@ Pre-requisites for restoring snapshots containing searchable snapshot indices ac Previous versions had issues restoring the snapshot or recovering searchable snapshot indices in case of, for example, node failure. -::::{important} +::::{important} The snapshot in the source cluster MUST NOT be deleted even after being successfully restored in the destination cluster. In fact, that’s also the case for the searchable snapshots in the source cluster for which there were indices backed by the restored snapshot. These snapshots are required for recovery of the searchable snapshot indices in case of, for example, node failure. This means that until you delete the searchable snapshot indices in the destination cluster, you must not delete your source deployment, delete the restored snapshot, or delete any of the searchable snapshots used by the searchable snapshot indices. diff --git a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-existing-deployment.md b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-existing-deployment.md index 82a5230d74..975d94cbb8 100644 --- a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-existing-deployment.md +++ b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-existing-deployment.md @@ -1,6 +1,7 @@ --- mapped_pages: - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-restore-snapshots-into-existing-deployment.html + - https://www.elastic.co/guide/en/cloud/current/ec-restore-snapshots-into-existing-deployment.html --- # Restore snapshot into an existing deployment [ece-restore-snapshots-into-existing-deployment] diff --git a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-new-deployment.md b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-new-deployment.md index 7c1d6c8757..901a77e4a2 100644 --- a/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-new-deployment.md +++ b/deploy-manage/tools/snapshot-and-restore/ece-restore-snapshots-into-new-deployment.md @@ -1,6 +1,7 @@ --- mapped_pages: - https://www.elastic.co/guide/en/cloud-enterprise/current/ece-restore-snapshots-into-new-deployment.html + - https://www.elastic.co/guide/en/cloud/current/ec-restore-snapshots-into-new-deployment.html --- # Restore snapshot into a new deployment [ece-restore-snapshots-into-new-deployment] diff --git a/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md b/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md index ff3bd723c8..0309415805 100644 --- a/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md +++ b/explore-analyze/machine-learning/anomaly-detection/anomaly-how-tos.md @@ -2,6 +2,7 @@ navigation_title: "How-tos" mapped_pages: - https://www.elastic.co/guide/en/machine-learning/current/anomaly-how-tos.html + - https://www.elastic.co/guide/en/serverless/current/observability-aiops-tune-anomaly-detection-job.html --- # How-tos [anomaly-how-tos] @@ -13,7 +14,7 @@ Though it is quite simple to analyze your data and provide quick {{ml}} results, * [Using runtime fields in {{dfeeds}}](ml-configuring-transform.md) * [Customizing detectors with custom rules](ml-configuring-detector-custom-rules.md) * [Detecting anomalous categories of data](ml-configuring-categories.md) -* [Performing population analysis](https://www.elastic.co/guide/en/machine-learning/current/ml-configuring-populations.html) +* [Performing population analysis](ml-configuring-populations.md) * [Reverting to a model snapshot](ml-reverting-model-snapshot.md) * [Detecting anomalous locations in geographic data](geographic-anomalies.md) * [Mapping anomalies by location](mapping-anomalies.md) diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-ad-forecast.md b/explore-analyze/machine-learning/anomaly-detection/ml-ad-forecast.md index 958a3b7790..cb9031f535 100644 --- a/explore-analyze/machine-learning/anomaly-detection/ml-ad-forecast.md +++ b/explore-analyze/machine-learning/anomaly-detection/ml-ad-forecast.md @@ -1,6 +1,7 @@ --- mapped_pages: - https://www.elastic.co/guide/en/machine-learning/current/ml-ad-forecast.html + - https://www.elastic.co/guide/en/serverless/current/observability-aiops-forecast-anomalies.html --- # Forecast future behavior [ml-ad-forecast] diff --git a/explore-analyze/machine-learning/anomaly-detection/ml-configuring-populations.md b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-populations.md new file mode 100644 index 0000000000..4308bac770 --- /dev/null +++ b/explore-analyze/machine-learning/anomaly-detection/ml-configuring-populations.md @@ -0,0 +1,89 @@ +--- +mapped_pages: + - https://www.elastic.co/guide/en/machine-learning/master/ml-configuring-populations.html +--- + +# Performing population analysis [ml-configuring-populations] + +Population analysis is a method of detecting anomalies by comparing the behavior of entities or events within a specified population. In this approach, {{ml}} analytics create a profile of what is considered "typical" behavior for users, machines, or other entities over a specified time period. An entity is considered as anomalous when its behavior deviates from that of the population, indicating abnormal activity compared to the rest of the population. + +This type of analysis is most effective when the behavior within a group is generally homogeneous, allowing for the identification of unusual patterns. However, it is less useful when members of the population show vastly different behaviors. In such cases, you can segment your data into groups with similar behaviors and run separate jobs for each. This can be done by using a query filter in the datafeed or by applying the `partition_field_name` to split the analysis across different groups. + +Population analysis is resource-efficient and scales well, enabling the analysis of populations consisting of hundreds of thousands or even millions of entities with a lower resource footprint than analyzing each series individually. + + +## Recommendations [population-recommendations] + +* Use population analysis when the behavior within a group is mostly homogeneous, as it helps identify anomalous patterns effectively. +* Leverage population analysis when dealing with large-scale datasets. +* Avoid using population analysis when members of the population exhibit vastly different behaviors, as it may not be effective. + + +## Creating population jobs [creating-population-jobs] + +1. In {{kib}}, navigate to **Jobs**. To open **Jobs**, find **{{ml-app}} > Anomaly Detection** in the main menu, or use the [global search field](https://www.elastic.co/guide/en/kibana/current/kibana-concepts-analysts.html#_finding_your_apps_and_objects). +2. Click **Create job**, select the {{data-source}} you want to analyze. +3. Select the **Population** wizard from the list. +4. Choose a population field - it’s the `clientip` field in this example - and the metric you want to use for the analysis - `Mean(bytes)` in this example. + + :::{image} ../../../images/machine-learning-ml-population-wizard.png + :alt: Creating a population job in Kibana + :class: screenshot + ::: + +5. Click **Next**. +6. Provide a job ID and click **Next**. +7. If the validation is successful, click **Next** to review the summary of the job creation. +8. Click **Create job**. + +::::{dropdown} API example +To specify the population, use the `over_field_name` property. For example: + +```console +PUT _ml/anomaly_detectors/population +{ + "description" : "Population analysis", + "analysis_config" : { + "bucket_span":"15m", + "influencers": [ + "clientip" + ], + "detectors": [ + { + "function": "mean", + "field_name": "bytes", + "over_field_name": "clientip" <1> + } + ] + }, + "data_description" : { + "time_field":"timestamp", + "time_format": "epoch_ms" + } +} +``` + +1. This `over_field_name` property indicates that the metrics for each client (as identified by their IP address) are analyzed relative to other clients in each bucket. + + +:::: + + + +### Viewing the job results [population-job-results] + +Use the **Anomaly Explorer** in {{kib}} to view the analysis results: + +:::{image} ../../../images/machine-learning-ml-population-anomalies.png +:alt: Population results in the Anomaly Explorer +:class: screenshot +::: + +The results are often quite sparse. There might be just a few data points for the selected time period. Population analysis is particularly useful when you have many entities and the data for specific entitles is sporadic or sparse. If you click on a section in the timeline or swim lanes, you can see more details about the anomalies: + +:::{image} ../../../images/machine-learning-ml-population-anomaly.png +:alt: Anomaly details for a specific user +:class: screenshot +::: + +In this example, the client IP address `167.145.234.154` received a high volume of bytes on the date and time shown. This event is anomalous because the mean is four times higher than the expected behavior of the population. diff --git a/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-aiops.md b/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-aiops.md index b774405ca7..b81a7eee4d 100644 --- a/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-aiops.md +++ b/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-aiops.md @@ -1,6 +1,9 @@ --- mapped_pages: - https://www.elastic.co/guide/en/kibana/current/xpack-ml-aiops.html + - https://www.elastic.co/guide/en/serverless/current/observability-machine-learning.html + - https://www.elastic.co/guide/en/serverless/current/observability-aiops-analyze-spikes.html + - https://www.elastic.co/guide/en/serverless/current/observability-aiops-detect-change-points.html --- # AIOps Labs [xpack-ml-aiops] diff --git a/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-anomalies.md b/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-anomalies.md index 12f2b348cc..416d5044a0 100644 --- a/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-anomalies.md +++ b/explore-analyze/machine-learning/machine-learning-in-kibana/xpack-ml-anomalies.md @@ -1,6 +1,7 @@ --- mapped_pages: - https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html + - https://www.elastic.co/guide/en/serverless/current/observability-aiops-detect-anomalies.html --- # Anomaly detection [xpack-ml-anomalies] diff --git a/explore-analyze/toc.yml b/explore-analyze/toc.yml index a7d781b889..80d8488f5e 100644 --- a/explore-analyze/toc.yml +++ b/explore-analyze/toc.yml @@ -163,6 +163,7 @@ toc: - file: machine-learning/anomaly-detection/ml-configuring-transform.md - file: machine-learning/anomaly-detection/ml-configuring-detector-custom-rules.md - file: machine-learning/anomaly-detection/ml-configuring-categories.md + - file: machine-learning/anomaly-detection/ml-configuring-populations.md - file: machine-learning/anomaly-detection/ml-reverting-model-snapshot.md - file: machine-learning/anomaly-detection/geographic-anomalies.md - file: machine-learning/anomaly-detection/mapping-anomalies.md @@ -338,7 +339,7 @@ toc: children: - file: alerts-cases/alerts.md children: - - file: alerts-cases/alerts/alerting-getting-started.md + - file: alerts-cases/alerts/alerting-getting-started.md - file: alerts-cases/alerts/alerting-setup.md - file: alerts-cases/alerts/create-manage-rules.md - file: alerts-cases/alerts/view-alerts.md diff --git a/images/machine-learning-ml-population-anomalies.png b/images/machine-learning-ml-population-anomalies.png new file mode 100644 index 0000000000..8ff3c39967 Binary files /dev/null and b/images/machine-learning-ml-population-anomalies.png differ diff --git a/images/machine-learning-ml-population-anomaly.png b/images/machine-learning-ml-population-anomaly.png new file mode 100644 index 0000000000..da367f8d50 Binary files /dev/null and b/images/machine-learning-ml-population-anomaly.png differ diff --git a/images/machine-learning-ml-population-wizard.png b/images/machine-learning-ml-population-wizard.png new file mode 100644 index 0000000000..14e86d6869 Binary files /dev/null and b/images/machine-learning-ml-population-wizard.png differ