Regarding the Elastic Search Machine Learning Model for Anomaly Detection

Does a single model detect anomalies for all use-cases? Or, is their different models used for different use-cases to detect anomalies?

In Elastic ML, the models used are built on the fly, custom to that data set and depending how the ML job is configured. Every entity within the data can have its own independent model.

If you are interested in what's happening behind the scenes, there is a lot of good information in the following videos:

30 Min Overview with Prelert founder Steve Dodson:

Machine Learning and Statistical Methods for Time Series Analysis (2017 ElasticON):

The Math Behind Elastic Machine Learning (2018 ElasticON):

1 Like

Hi, thanks a lot for your valuable response. But I cannot fully understand the line "Every entity within the data can have its own independent model". Can you please tell me, what does "entity" means here?

And, based on my overall understanding, there can be different ML models with different features for different use-cases, right?

For example, if I have an ML job that is looking at a metric per server, or a response time per API call, then the server and the API call are the entities in these examples.

Each will get a unique model.

1 Like

Thank you very much @richcollier.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.