# Configuring ML Anomaly Detection

**URL:** <https://discuss.elastic.co/t/configuring-ml-anomaly-detection/105900>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [October 31, 2017, 2:22pm UTC](https://discuss.elastic.co/t/configuring-ml-anomaly-detection/105900 "2017-10-31T14:22:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mping](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mping/32/23615_2.png) [@mping](https://discuss.elastic.co/u/mping)\
**Post date:** [October 31, 2017, 2:22pm UTC](https://discuss.elastic.co/t/configuring-ml-anomaly-detection/105900/1 "2017-10-31T14:22:59Z")

</div>

What kind of fine tune is available for Anomaly Detection? I'll give an example:

Suppose we have a timeseries where we are expecting a certain events (eg: 1000-5000) per day;  
On our evaluation, if we have a stream of values [..., 1000, 0, 0 ,0, ...], the detection will "detect" the first 0 as warning, but then it will assume the next zeroes as less severe and it seems that it will accept the 0's as "normal".

Is this behaviour configurable in any way? Or it's the nature of the unsupervised ML algorithm?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 31, 2017, 6:16pm UTC](https://discuss.elastic.co/t/configuring-ml-anomaly-detection/105900/2 "2017-10-31T18:16:45Z")

</div>

Truly, the nature of the unsupervised learning will mean that ML will make judgements without human intervention. But, with that said, you do have control over several aspects. For one, if you want to not include counts of zero in the modeling, you would choose the `non_zero_count` based functions over the `count` ones. For numerical fields, you have control over "one-sided" analyses (like choosing `max` if you don't care about numerical anomalies on the low side of things). You also have control over the `bucket_span` if it is desirable to "smooth out" the data before it is modeled.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2017, 6:17pm UTC](https://discuss.elastic.co/t/configuring-ml-anomaly-detection/105900/3 "2017-11-28T18:17:06Z")

</div>

Closed on November 28, 2017, 6:17pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.