Hi,
I've got a question regarding the scoring system of ELK anomaly detection.
I've been running a job with 'high_sum' detector, and there was an anomaly with record score 99 but actual value of the sum of the field was 0.
The field the detector referst to is 'bytes' so 0 is the smallest value.
It's clearly not a high_sum anomaly, still such thing (detecting buckets with actual value=0 as high anomaly) happens time to time.
Does anyone happen to know why such error occurs?