How data for 'Overall' field in 'Anomaly Explorer' window is calcualted

Elastic Stack Elasticsearch
1

Hi,

I have created a 'multi metric job' analysis for a given data. After completing the analysis, I check my results from 'Anomaly Explorer' window. From the documents I understand, the anomaly is calculated independently for each available metric based on their own history and finally grouped together inside a single container to be displayed in 'Anomaly Explorer' window. I see an row field called 'Overall' at the top of 'Anomaly Explorer' window. I would like to know how the values are calculated and populated for that field. Is it an average of all the individual anomaly scores for the corresponding time in all metrics or calculated in a different way?

Thank you.

2

Hi,

Each Machine Learning job generates different types of results, and the anomaly scores from each of these result types are displayed in the various components of the Anomaly Explorer view (Top Influencers, Anomaly Timeline, anomaly charts and table).

The Overall lane at the top of the Anomaly timeline displays the maximum anomaly scores of the 'bucket influencer' result type. The bucket influencer results are an aggregation of each of the 'influencers' you chose when creating the multi metric job, selected in the 'Key fields' section of the Multi Metric job wizard.

In addition to any 'field' influencers you selected when creating the job, there is a built-in bucket influencer, called 'bucket_time'. This bucket influencer is the aggregation of all the anomaly records in each time bucket.

The calculation behind the bucket_influencer anomaly score displayed in the Overall timeline is more complex than just a simple average of all the individual record anomaly scores, but will have a contribution from the influencer scores in each bucket.

More information on the scores used in the various components of the Anomaly Explorer window can be found in this post, and there is information on the bucket_influencer result type in the docs here.

Hope that helps
Pete

3

Hi Pete,

Thanks for the detailed explanation.

Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.