@@ -17,11 +17,29 @@ anomalies, and the frequency at which alerting is required.
1717
1818When you view your {ml} results, each bucket has an anomaly score. This score is
1919a statistically aggregated and normalized view of the combined anomalousness of
20- all the record results in the bucket. If you have more than one job, you can
21- also obtain overall bucket results, which combine and correlate anomalies from
22- multiple jobs into an overall score. When you view the results for jobs groups
23- in {kib}, it provides the overall bucket scores.
20+ all the record results in the bucket.
21+
22+ In 6.5 and later releases, the {ml} analytics enhance the anomaly score for each
23+ bucket by considering
24+ //TBD: preceding?
25+ contiguous buckets. This extra _multi-bucket analysis_ effectively uses a
26+ sliding window to evaluate the events in each bucket relative to the larger
27+ context of recent events. When you review your {ml} results, there is a
28+ `multi_bucket_impact` property that indicates how strongly the final anomaly
29+ score is influenced by multi-bucket analysis. In {kib}, anomalies with medium or
30+ high multi-bucket impact are depicted in the *Anomaly Explorer* and the
31+ *Single Metric Viewer* with a cross symbol instead of a dot. For example:
32+
33+ [role="screenshot"]
34+ image::ml/images/multibucketanalysis.jpg["Examples of anomalies with multi-bucket impact in {kib}"]
2435
25- For more information, see
26- {ref}/ml-results-resource.html[Results Resources] and
27- {ref}/ml-get-overall-buckets.html[Get Overall Buckets API].
36+ In this example, you can see that some of the anomalies fall within the shaded
37+ blue area, which represents the bounds for the expected values. The bounds are
38+ calculated per bucket, but multi-bucket analysis is not limited by that scope.
39+
40+ If you have more than one job, you can
41+ also obtain overall bucket results, which combine and correlate anomalies from
42+ multiple jobs into an overall score. When you view the results for job groups
43+ in {kib}, it provides the overall bucket scores. For more information, see
44+ {ref}/ml-results-resource.html[Results resources] and
45+ {ref}/ml-get-overall-buckets.html[Get overall buckets API].
0 commit comments