[Jobs] Add threshold information to calculate anomlay score

Elastic Stack Elasticsearch
1

Hello

Do you know if I can add a threshold information to calculate anomaly score?
Example:
I'm analysing a metric with values between 1 to 450. Generaly values are between 435-450. But actually all values higher than 400 must be considered "normal". So I need to add this information to the job .
How can I do this please?

Thanks for your help.

Yazid

2

Hello Yazid,

The ML jobs currently don't allow threshold logic on top of the existing anomaly detection. If you need this now you have a few choices:

  1. Filter the input data by customizing the query that the ML datafeed uses. In other words, exclude data between 400-450.
  2. Post-process the anomalies (i.e. with Watcher/Alerting) and exclude any anomalies that have an actual value between 400-450.

Or, do you need to use ML at all for this use case? Just use a static threshold for anything below 400?

3

Hello Rich

Thanks for your clear answer.

Maybe 2nd option will be OK for me.

And yes I need ML for this use case, because my question was simple (intentionally) but in practice it is a bit more complicated :slight_smile: . I just needed to understand how it works.

Thanks again.