# What are the similarities and/or differences between Rare Jobs and Population Jobs in Elastic Cloud Machine Learning for Anomaly Detection?

**URL:** <https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460>\
**Category:** Elastic Security\
**Created:** [February 12, 2025, 10:25pm UTC](https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460 "2025-02-12T22:25:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Illya\_Bjazevic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/illya_bjazevic/32/139677_2.png) [@Illya\_Bjazevic](https://discuss.elastic.co/u/Illya_Bjazevic)\
**Post date:** [February 12, 2025, 10:25pm UTC](https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460/1 "2025-02-12T22:25:47Z")

</div>

Entities or events in your data can be considered anomalous when:

- Their behavior changes over time, relative to their own previous behavior, or
- Their behavior is different than other entities in a specified population.

The latter method of detecting anomalies is known as _population analysis_.

I found this on the Elastic website. However, it is an old link. This is what I have always had in mind. Is it still valid? (This is the link: [Performing population analysis | Machine Learning in the Elastic Stack [7.17] | Elastic](https://www.elastic.co/guide/en/machine-learning/7.17/ml-configuring-populations.html))

Additionally, I also found that for Rare Jobs, the `rare` function detects values that occur rarely in time or rarely for a population. It detects anomalies according to the number of distinct rare values.

This function supports the following properties:

- `by_field_name` (required)
- `over_field_name` (optional)
- `partition_field_name` (optional)

This is the link: [Appendix N: Rare functions | Machine Learning in the Elastic Stack [8.17] | Elastic](https://www.elastic.co/guide/en/machine-learning/8.17/ml-rare-functions.html)

Finally, the latest page of Elastic about this topic mentions both, but the explanation is not 100% clear to me. ([Anomaly detection job types | Machine Learning in the Elastic Stack [8.17] | Elastic](https://www.elastic.co/guide/en/machine-learning/current/ml-anomaly-detection-job-types.html#rare-jobs))

It is my understanding, please correct me if I am wrong, that both types of jobs required Time Series data.

Finally, Rare Jobs had (not sure if it is still valid): Rare, Rare in Population, and Frequently Rare in Population.

Here is the image that I took from a Elastic video on YouTube ( [A walk through anomaly detection using Elastic's Machine Learning - YouTube](https://www.youtube.com/watch?v=Ca4_5AMvboU&t=900s)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/5/451105361342b01b5bc1b6bcb5a61dfcb7b2f527.jpeg)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/225387ec67b08b4b2a74d3f3af0267106a238e05.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7e502391b07ad1e9f85e125dedea058dcf2b035.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 12, 2025, 10:26pm UTC](https://discuss.elastic.co/t/what-are-the-similarities-and-or-differences-between-rare-jobs-and-population-jobs-in-elastic-cloud-machine-learning-for-anomaly-detection/374460/2 "2025-03-12T22:26:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.