OK, so i'm loving elasticsearch 6.0.
I'm a data scientist, and so i'm keen to understand how anomaly detection can work for my data.
I put in my data and i start playing around with ML, following various tutorials.
I am finding that it does not seem to be finding anomalies as I would expect.
For example, consider the data below - its a bunch of events collected, and each event has a PID, top 10 shown:
If i just focus on one value of PID via search, then I see this graph:
I would think that there are clearly some anomalies here.
So i setup an ML job based on this search (multi-metric).
When I run it, I get no anomalies:
If i click on the results in the time series analysis, I get a nice graph, but no anomaly results:
Am I doing something wrong ? Are my assumptions wrong ?
Also...even if I did get this to work...It seems to be that ElasticSearch is not really machine learning at all, but its statistically analysis ( training ) and threshold checking ( detection ).
What might I be missing, in execution, and in theory, in what ElasticSearch ML is trying to do ?