Machine Learning job for counters who need delta's

Elastic Stack Kibana
1

Hello,

We have some data like sflows which has fields:

  • output_octets
  • input_octets
    the values of the above fields is an incrementing counter.

Is there a way to make an Elastic machine learning job which can detect drops in traffic somehow? To do that it would have to detect changes in the rate the octets increment. I've tried, but was unable to do that.

Grtz

Willem

2

Not sure what you tried, but this should work fine as is. I just did a quick mockup using the following CSV, with a contrived discontinuity of slope in it:

Imported into elasticsearch with File Upload. Configured an ML job:

image
image.jpg2560×1266 290 KB

It properly found the discontinuity:

image
image.jpg2566×1162 332 KB

3

@richcollier Can it also show this per host? Do I need to configure the host as influencer?

4

Yes, you could do it per host - just use the Multi-metric job wizard and split on host

5

@richcollier Thanks, I think I got it:

image
image.png1408×663 106 KB

6

Cool - but it would be more effective to split the analysis on host using the Multi-metric job wizard rather than merely relying on using the host as an influencer.

7

Got it, used switchinterface alias as split field looks promising. Curious at the results in a few weeks. Tx for the help.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.