I created two ML jobs in kibana
- With min and max threshold values in order to filter out the false positives
PUT _ml/anomaly_detectors/rule_test_threshold
{
"analysis_config": {
"bucket_span": "15m",
"detectors": [
{
"detector_description": """distinct_count("uniqueid.keyword")""",
"function": "distinct_count",
"field_name": "uniqueid.keyword",
"detector_index": 0,
"custom_rules": [
{
"actions": [
"skip_result"
],
"conditions": [
{
"applies_to": "actual",
"operator": "gt",
"value": 1550
},
{
"applies_to": "actual",
"operator": "lt",
"value": 100
}
]
}
]
}
]
},
"data_description": {
"time_field": "@timestamp",
"time_format": "epoch_ms"
},
"datafeed_config": {
"query": {
"bool": {
"must": [
{
"match_phrase": {
"servicename": "test:_post"
}
}
]
}
},
"indices": [
"test-data-*"
]
}
}
- Without any min and max threshold values, just to take the document count based on certain unique filed and display the anomalies.
When I compared the anomalies graph, both of the jobs were giving the same results; can someone please assist me why the ML job with min and max condition is not calculating the anomalies based on the threshold values
Thanks in advance !
Regards, Nivedita