I have a monitor that tracks 6 message queues that come into my system. I record the stats in an index capturing if the queue has been idle at all and what volume of data has been going through it.
If I make a ML job with a query that monitors the stats on those queues alone and set the names of the queues as influencers would that alert me if one of the individual queues showed an anomoly over the score listed in the watch or would the overall score need to breach before an alert was raised?
I've created the watch just by starting the data feed and telling elastic to create the watch for me so it maybe that I need to make a change to that default behaviour to get it alerting like I want but when I've tried to tweak down the thresholds it seems like it isn't alerting on individual queues only then the total goes over so I've been setting up targeted ML jobs on a queue by queue basis for those that I really need to observe.
What I'd really like though is a blanket job that will monitor all the queues with the queue name as an influencer, with the ML accpeting that not all queues are the same and then flag up anomolies that occur at the queue level.
If anyone has any advice on how to go about this it would be much appreceated.
King regards and thanks in advance