Multi-Bucket scoring is a bit confusing. I've read through the blog, but questions remain. How is the multi-bucket score calculated? Does the model go backwards and recalculate multi-bucket scores as more data is processed or does it get one score for each bucket with no recalculation?
Multi-bucket impacts will alert way too often for us so I would like to alert only on non-multi-bucket impact buckets. Also, when multi-bucket anomalies are present, zero and low counts will show in a high count detector (not my favorite feature). A high count detector should only show high counts. If I set my alert to only look for multi-bucket impact scores less than 0 am I guaranteed to get only one alert for a multi-bucket anomaly? How is the Kibana multi-bucket rating of high, medium, and low determined?