Elasticsearch watcher to send Prediction data

Elastic Stack Elasticsearch
1

Elasticsearch watcher to send prediction data.

image
image.png590×538 22 KB

In this above screenshot, I have the prediction value as 32192.
So, is it possible to alert the user (by using watcher) with the prediction value?

My watcher configuration is,

         {
              "range": {
                "anomaly_score": {
                  "gte": "30"
                }
              }
        }
  1. Is it possible to include prediction value inside range?
  2. Is it possible to include prediction value in slack text?
    "text": "Machine Learning Results - Object cache size is going to exceed threshold limit.\n Anomalies:\n{{#ctx.payload.hits.hits}}score={{_source.anomaly_score}} at time={{_source.timestamp}}\n{{/ctx.payload.hits.hits}}"

If so, could you please let me know the syntax?

Thanks in advance.

2

Hey,

I am not sure what you are referring to with the first question. Something you could do is to put the anomaly score in the watch metadata like

"metadata" : { "score" : "30" }

and then do this in your query

"range": {  "anomaly_score": { "gte": "{{ctx.metadata.score}}" } }

and also refer to this in the slack message via {{ctx.metadata.score}}.

Your second assumption is correct, that this will return all the anomaly scors of the hits being returned.

Hope this helps!

--Alex

3

Alright. Thanks for that. It clarifies my few other questions. :slight_smile:

My use case,

In the screenshot I provided, When prediction value goes beyond 32000, I want to alert users along with the prediction value and prediction date in the alert text.

In watcher, I configured the alert text as

"text": "Machine Learning Results - Object cache size is going to exceed threshold limit.\n Anomalies:\n{{#ctx.payload.hits.hits}}score={{_source.anomaly_score}} at time={{_source.timestamp}}\n{{/ctx.payload.hits.hits}}"

Alert should look something like,

As per prediction, Object cache size is going to be at <prediction value> on <future date>.

How do I include both <prediction value> and <future date>data in alert text.
Is there anything like {{ctx.payload.hits.hits.0.prediction}}?

4

For forecasts, you do NOT want to use anomaly_score as the thing you're reporting on. Instead, use forecast_prediction . Please reference this other thread:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.