Machine Learning functions

[mkemalm]

Hi,

in ML jobs functions are categorized in three groups; function itself, low function and high function. For example sum, low sum, high sum. ELK documents explain those functions as;

function itself detects anomalies in a bucket
low detects anomalies in a usual low bucket (when sth begins to increase)
high detects anomalies in a usual high bucket(when sth begins to decrease)

What is the point of using low or high instead of common anomaly detection function?

[polyfractal (Zachary Tong)]

There are some situations where you don't care about the value moving in one direction, but care if it goes the other way. So for high_sum, you only care if the value is anomalously high. If it's anomalously low that's ok. For example, if your websites latency is normally 100ms, you may not care if it dips to 20ms, but you certainly care if it spikes to 1000ms. So a "high" function is what you're looking for.

Ditto for "low" functions, except the other direction.

The function itself is used if you care about any change in the value, going high or low. It's basically high + low together in one function.