elasticsearch ML job with greater than and less than condition is not working as expected

Viewed 12

I created two ML jobs in kibana

  1. With min and max threshold values in order to filter out the false positives
PUT _ml/anomaly_detectors/rule_test_threshold
{
 "analysis_config": {
   "bucket_span": "15m",
   "detectors": [
     {
       "detector_description": """distinct_count("uniqueid.keyword")""",
       "function": "distinct_count",
       "field_name": "uniqueid.keyword",
       "detector_index": 0,
       "custom_rules": [
         {
           "actions": [
             "skip_result"
           ],
           "conditions": [
             {
               "applies_to": "actual",
               "operator": "gt",
               "value": 1550
             },
             {
               "applies_to": "actual",
               "operator": "lt",
               "value": 100
             }
           ]
         }
       ]
     }
   ]
 },
 "data_description": {
   "time_field": "@timestamp",
   "time_format": "epoch_ms"
 },
 "datafeed_config": {
   "query": {
     "bool": {
       "must": [
         {
           "match_phrase": {
             "servicename": "test:_post"
           }
         }
       ]
     }
   },
   "indices": [
     "test-data-*"
   ]
 }
}  
  1. Without any min and max threshold values, just to take the document count based on certain unique filed and display the anomalies.

When I compared the anomalies graph, both of the jobs were giving the same results; can someone please assist me why the ML job with min and max condition is not calculating the anomalies based on the threshold values

Thanks in advance !

Regards, Nivedita

0 Answers
Related