You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: x-pack/docs/en/ml/functions.asciidoc
+13-28Lines changed: 13 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,27 +18,6 @@ variations (for example, `count`, `low_count`, and `high_count`). These variatio
18
18
apply one-sided tests, detecting anomalies only when the values are low or
19
19
high, depending one which alternative is used.
20
20
21
-
//For some functions, you can optionally specify a field name in the
22
-
//`by_field_name` property. The analysis then considers whether there is an
23
-
//anomaly for one of more specific values of that field. In {kib}, use the
24
-
//**Key Fields** field in multi-metric jobs or the **by_field_name** field in
25
-
//advanced jobs.
26
-
////
27
-
TODO: Per Sophie, "This is incorrect... Split Data refers to a partition_field_name. Over fields can only be added in Adv Config...
28
-
29
-
Can you please remove the explanations for by/over/partition fields from the documentation for analytical functions. It's a complex topic and will be easier to review in a separate exercise."
30
-
////
31
-
32
-
//For some functions, you can also optionally specify a field name in the
33
-
//`over_field_name` property. This property shifts the analysis to be population-
34
-
//or peer-based and uses the field to split the data. In {kib}, use the
35
-
//**Split Data** field in multi-metric jobs or the **over_field_name** field in
36
-
//advanced jobs.
37
-
38
-
//You can specify a `partition_field_name` with any function. The analysis is then
39
-
//segmented with completely independent baselines for each value of that field.
40
-
//In {kib}, use the **partition_field_name** field in advanced jobs.
41
-
42
21
You can specify a `summary_count_field_name` with any function except `metric`.
43
22
When you use `summary_count_field_name`, the {ml} features expect the input
44
23
data to be pre-aggregated. The value of the `summary_count_field_name` field
@@ -55,13 +34,6 @@ functions are strongly affected by empty buckets. For this reason, there are
55
34
`non_null_sum` and `non_zero_count` functions, which are tolerant to sparse data.
56
35
These functions effectively ignore empty buckets.
57
36
58
-
////
59
-
Some functions can benefit from overlapping buckets. This improves the overall
60
-
accuracy of the results but at the cost of a 2 bucket delay in seeing the results.
61
-
62
-
The table below provides a high-level summary of the analytical functions provided by the API. Each of the functions is described in detail over the following pages. Note the examples given in these pages use single Detector Configuration objects.
63
-
////
64
-
65
37
* <<ml-count-functions>>
66
38
* <<ml-geo-functions>>
67
39
* <<ml-info-functions>>
@@ -70,10 +42,23 @@ The table below provides a high-level summary of the analytical functions provid
0 commit comments