Machine Learning job for counters who need delta's

[willemdh]

Hello,

We have some data like sflows which has fields:

• output_octets
• input_octets
  the values of the above fields is an incrementing counter.

Is there a way to make an Elastic machine learning job which can detect drops in traffic somehow? To do that it would have to detect changes in the rate the octets increment. I've tried, but was unable to do that.

Grtz

Willem

[richcollier]

Not sure what you tried, but this should work fine as is. I just did a quick mockup using the following CSV, with a contrived discontinuity of slope in it:

https://gist.github.com/richcollier/a42bc40c31bec8216391e76c79e5d491

Imported into elasticsearch with File Upload. Configured an ML job:

It properly found the discontinuity:

[willemdh]

@richcollier Can it also show this per host? Do I need to configure the host as influencer?

[richcollier]

Yes, you could do it per host - just use the Multi-metric job wizard and split on host

[willemdh]

@richcollier Thanks, I think I got it:

[richcollier]

Cool - but it would be more effective to split the analysis on host using the Multi-metric job wizard rather than merely relying on using the host as an influencer.

[willemdh]

Got it, used switchinterface alias as split field looks promising. Curious at the results in a few weeks. Tx for the help.