In the image that I posted below, there seems to be two red dots located on September 12 2017. Looking at the graph, it looks as if the red dots should correspond to the 2 obvious peaks -- the description of the red dot shows that the actual value is 66.1. But the red dot appears to be located following the peak.
Is this a bug and if so how can I resolve this so that the UI puts the red dot in the correct location at the top of the peak?
Do you see the same issue if you zoom in (change the date filter in kibana) to only the day of 9-12-2017?
I bet this is just an artifact of the current zoom level causing a mis-matched time interval (i.e. the job's bucket_span versus the interval of the chart). Zoom in far enough so that the two intervals are the same
The image you posted would seem to indicate that there is an issue with the way we position the anomaly marker dots on the chart for cases where the aggregation interval used to plot the data is greater than the bucket span of the job (which are displayed in the label above the chart as shown in the image posted by @richcollier.
Currently in this situation we position the anomaly dot on the chart point which is closest in time to the time of anomaly. However as your example shows, when the closest point occurs after the time of anomaly, this does not correspond to the chart bucket which contains the anomaly. Instead the dot should be placed on the chart point before the time of the anomaly.
I have managed to reproduce myself, and have raised a GitHub issue for this, and will look to fix it shortly.
In the meantime, as you found, using the 'auto' zoom interval ensures the data in the chart is plotted at the same interval as the bucket span of the job, so the anomaly dots will always be positioned correctly.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
