Regarding the Elastic Search Machine Learning Model for Anomaly Detection

[Tahmid_Rahman (tahmedge)]

Does a single model detect anomalies for all use-cases? Or, is their different models used for different use-cases to detect anomalies?

[richcollier]

In Elastic ML, the models used are built on the fly, custom to that data set and depending how the ML job is configured. Every entity within the data can have its own independent model.

If you are interested in what's happening behind the scenes, there is a lot of good information in the following videos:

30 Min Overview with Prelert founder Steve Dodson:

Machine Learning and Statistical Methods for Time Series Analysis (2017 ElasticON):

https://www.elastic.co/elasticon/conf/2017/sf/machine-learning-and-statistical-methods-for-time-series-analysis

The Math Behind Elastic Machine Learning (2018 ElasticON):

https://www.elastic.co/elasticon/conf/2018/sf/the-math-behind-elastic-machine-learning

[Tahmid_Rahman (tahmedge)]

Hi, thanks a lot for your valuable response. But I cannot fully understand the line "Every entity within the data can have its own independent model". Can you please tell me, what does "entity" means here?

And, based on my overall understanding, there can be different ML models with different features for different use-cases, right?

[richcollier]

For example, if I have an ML job that is looking at a metric per server, or a response time per API call, then the server and the API call are the entities in these examples.

Each will get a unique model.

[Tahmid_Rahman (tahmedge)]

Thank you very much @richcollier.