Hello ,
I'm using machine learning detector on version 7.17.
I would like to detect unusually low number of users.
I m using for that low_distinct_count as function.
It works fine when at least there is at least one user .
Exemple
if the number of user goes from 17 to 1 , this decrease is well detected
if the number of user goes from 17 to 0 , this decrease is NOT detected
Are there any condition to add to the ML job so we can detect event if all users are lost?
This, in fact, should work as you are expecting it to. I'd love to see evidence (like a screenshot) of the situation that you describe with it not working! Please post here!
I stand corrected - it does ignore empty buckets, which is a little counter-intuitive to me but apparently, that's how it was designed. I've asked dev to consider making a feature enhancement to make the behavior optional (like we do by having count and non_zero_count function variants).
In the meantime, this can be accomplished via a workaround.
Note the name of the cardinality agg (here it is dc_airline) is the same as what's used in the detector definition (low_sum(dc_airline)) and the value of the summary_count_field_name
If you intend to split by using a by_field or a partition_field then your datafeed query has to also include a terms aggregation so that you get a service_cardinality value for every XYZ.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.