Anomaly Detection - Can' Forecast on Influencer

[erikg]

Hello,

I created a anomaly detection job on memory utilization. I am using host.name as an influencer
I see the forecast but when I run it doesn’t allow me to focus on an influencer?

My goal: I am trying to predict when memory will fill up on hosts

[erikg]

Hello, I figured it out:

Regardless of whether you have an influencer, you need to set a partition field:

PUT _ml/anomaly_detectors/disk_utilization_by_host

{

  "description": "Anomaly detection for disk utilization per host",

  "analysis_config": {

    "bucket_span": "15m",

    "detectors": [

      {

        "function": "max",

        "field_name": "system.filesystem.used.pct",

        "partition_field_name": "host.name"

      }

    ],

    "influencers": ["host.name"]

  },

  "data_description": {

    "time_field": "@timestamp"

  },

  "datafeed_config": {

    "indices": ["metricbeat-*", "metrics-*"],

    "query": {

      "bool": {

        "filter": [

          { "exists": { "field": "system.filesystem.used.pct" } }

        ]

      }

    }

  }

}

Which leads to this;