Skip to content

Commit a640978

Browse files
authored
[DOCS] Adds multi-bucket analysis to bucket overview
2 parents 58cdd45 + 3f5f651 commit a640978

File tree

2 files changed

+25
-7
lines changed

2 files changed

+25
-7
lines changed

docs/en/stack/ml/buckets.asciidoc

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,29 @@ anomalies, and the frequency at which alerting is required.
1717

1818
When you view your {ml} results, each bucket has an anomaly score. This score is
1919
a statistically aggregated and normalized view of the combined anomalousness of
20-
all the record results in the bucket. If you have more than one job, you can
21-
also obtain overall bucket results, which combine and correlate anomalies from
22-
multiple jobs into an overall score. When you view the results for jobs groups
23-
in {kib}, it provides the overall bucket scores.
20+
all the record results in the bucket.
21+
22+
In 6.5 and later releases, the {ml} analytics enhance the anomaly score for each
23+
bucket by considering
24+
//TBD: preceding?
25+
contiguous buckets. This extra _multi-bucket analysis_ effectively uses a
26+
sliding window to evaluate the events in each bucket relative to the larger
27+
context of recent events. When you review your {ml} results, there is a
28+
`multi_bucket_impact` property that indicates how strongly the final anomaly
29+
score is influenced by multi-bucket analysis. In {kib}, anomalies with medium or
30+
high multi-bucket impact are depicted in the *Anomaly Explorer* and the
31+
*Single Metric Viewer* with a cross symbol instead of a dot. For example:
32+
33+
[role="screenshot"]
34+
image::ml/images/multibucketanalysis.jpg["Examples of anomalies with multi-bucket impact in {kib}"]
2435

25-
For more information, see
26-
{ref}/ml-results-resource.html[Results Resources] and
27-
{ref}/ml-get-overall-buckets.html[Get Overall Buckets API].
36+
In this example, you can see that some of the anomalies fall within the shaded
37+
blue area, which represents the bounds for the expected values. The bounds are
38+
calculated per bucket, but multi-bucket analysis is not limited by that scope.
39+
40+
If you have more than one job, you can
41+
also obtain overall bucket results, which combine and correlate anomalies from
42+
multiple jobs into an overall score. When you view the results for job groups
43+
in {kib}, it provides the overall bucket scores. For more information, see
44+
{ref}/ml-results-resource.html[Results resources] and
45+
{ref}/ml-get-overall-buckets.html[Get overall buckets API].
289 KB
Loading

0 commit comments

Comments
 (0)