Automatic alerting on forcast (machine learning)

[Landry]

Hello,

How can we automate machine learning forcast execution in order to notify customers when some unusual events will occurs in the next days.

We have a machine learning job that detect anomalies on our datas. Actualy we use watcher to notify customers about thoses anomalies.

As the job and the datafeeders are always open we dont have to schedule the anomaly detection process pour self. Elastic do the job automaticaly.

But for forcast we dont know how we can automate the execution days after days.

Any help will be appreciate.

Thanks
Landry

[richcollier]

Hi Landry,

Just so you know - forecasting only forecasts trends in the data, not anomalies (as that would be impossible).

This question has been answered here in the forum before - see:

Combining Machine Learning forecasts with Watchers

Hello, Anyone knows if we can combine forecasts data with watchers. For example, I have created a forecast job that predicts the behavior of a product after 3 weeks. So, now I want gather these data and create a threshold alert using watchers. How can I use the data and how can I create an alert? Thank you very much in advance! Angelos

Alerting on forecast

Hi, im trying to alert when the forecast prediction value is greater than 95, I need to get the hostname (partition_value) and the time when the value surpass the treshold of 95, I currently can get the value and the partition_field_value, but I cant get the time. GET .ml-anomalies-custom-prediction*/_search { "size": 0, "query": { "bool": { "filter": { "range": { "timestamp": { "gte": "now", "lte": "now+4d", "format": "strict…

[Landry]

Hi Rich,

Your links are helpfull.

But, concerning the automation part, how can i put it in place ?

Il want to launch forcasting every day or evry week for the next day or the next week and then alert when some forcast hight.

Do elasticsearch provide a feature for that ? Or do i have to call de forcast API using an external scheduler ?

Thank you very much in advance!
Landry

[richcollier]

The forecasting itself doesn't have a scheduler, but you can use Watcher itself do accomplish this. You would have an independent Watch (separate from the Watch used for alerting) that did the following:

1. Runs every X (day, week, etc.)
2. executes the forecast API via the HTTP input
3. obtains the unique forecast_id from the response from the API call in 2)
4. Possibly stores this forecast_id in a lookup table/index using Watcher's indexing action with the timestamp of when the forecast was run for reference by the other, alerting Watch