I'm testing out monitoring the traffic load on a set of webservers in my environment. In this case I have the standard bumps of daily traffic on weekdays during office hours, and very low traffic on the weekend. However, when special events like a holiday come up ML will detect an anomaly and potentially set off alarms. What do you think would be the best way of handling this?
I was gonna ask the same question, as in France we have quite a few "off" days that can generate quite a lot of such anomalies 
If you know in advance that a day will be special, and not picked up by our standard periodicity detection, then one currently available option is to stop the datafeed at the beginning of the day in question and restart it at the end of the day (being sure to restart from "now" rather than the time of the last data). You'll then get no anomaly detection during the special day.
If you want anomaly detection during the special day but then want to remove the effect on the anomaly detection model afterwards, have a look at our model snapshot reversion functionality - https://www.elastic.co/guide/en/elasticsearch/reference/5.5/ml-revert-snapshot.html. At the end of the special day you'd stop the datafeed, close the job, revert the model to one from the day before and then reopen the job and restart the datafeed.
In the future we are also considering adding functionality to pre-schedule handling of special days. This is just a tentative idea at the moment, but it would probably be along the lines of offering one or both of the above approaches but configured in advance to be applied automatically on the appropriate day. We'd be interested to hear if you have any thoughts about how you'd like this functionality to work. We cannot promise we'll do exactly what you suggest, but it's always interesting to hear what users think would be most useful.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.