diff --git a/docs/reference/release-notes/highlights-6.5.0.asciidoc b/docs/reference/release-notes/highlights-6.5.0.asciidoc index ac6458fa1b2bb..a144b0551a6f0 100644 --- a/docs/reference/release-notes/highlights-6.5.0.asciidoc +++ b/docs/reference/release-notes/highlights-6.5.0.asciidoc @@ -22,10 +22,24 @@ the new File Data Visualizer in {kib}. [float] === Improved {ml} results for partitioned multi-metric jobs -If you use the `partition_field_name` parameter in a {ml} job (or the +If you use the +partition_field_name+ parameter in a {ml} job (or the *Split Data* field in the {kib} multi-metric job wizard), it generates many simultaneous analyses that are modeled independently. In 6.5, we have decreased the influence of the anomaly scores in each partition on other partitions' scores. The overall effect of the change is to produce a much wider range of scores in partitioned multi-metric jobs. +[float] +=== Find multi-bucket anomalies in {ml} jobs + +Sometimes events are not interesting or anomalous in the context of a single +bucket. However, they become interesting when you take into consideration a +sequence of buckets as a whole. In 6.5, there is a new {ml} +_multi-bucket analysis_, which uses features from multiple contiguous buckets +for anomaly detection. The final anomaly score is now a combination of values +from both the “standard” single-bucket analysis and the new multi-bucket +analysis. A new `multi_bucket_impact` property in the +<> indicates how strongly either form of +analysis influences the score. In {kib}, anomalies with medium or high +multi-bucket impact are depicted in the *Anomaly Explorer* and the +*Single Metric Viewer* with a cross symbol instead of a dot.