Elastic.co claims that ML reduces false positive but doesn't tell how.
To explain my question let's consider this scenario:
My aim is to monitor -using ML and ELK stack- a Java application installed on a Linux Host.
Let's say that suddenly there is a lot of traffic generated by/within the app (ex: a lot of visitors connecting to the GUI, JMS messages goes up,...), this means for example that the RAM usage (it can be the JVM instead, but let's keep the RAM) will grow significantly!
Is there any ML job applied to "RAM-used metric" that if the RAM usage grows and the traffic generated grows also, ML considers that situation normal and doesn't shoots a notification or consider it an anomaly ?!
Another general question: Can we (via api for example) tell the ML that a generated anomaly is a false positive and so delete it ?