[ML] lat_long anomaly not detected anymore
- Lenguaje dominante
- C++
- Estrellas
- 157
- Forks
- 67
- Merge medio
- 17 h 52 min
- PR fusionados (30 d)
- 20
Descripción
#### Summary
We used to have a job configuration that produced an anomaly and now it doesn't do that anymore, so we'd like to assess whether or not this is an expected change / a change we want to tolerate.
### Steps to reproduce
1. Install the Kibana ecommerce sample data
2. Create and run the anomaly detection lookback job (synchronize Kibana saved objects if needed)
Config
```
PUT _ml/anomaly_detectors/ecommerce-geo
{
"analysis_config" : {
"bucket_span":"15m",
"detectors": [
{
"detector_description": "Unusual coordinates by user",
"function": "lat_long",
"field_name": "geoip.location",
"by_field_name": "user"
}
],
"influencers": [
"geoip.country_iso_code",
"day_of_week",
"category.keyword",
"user"
]
},
"data_description" : {
"time_field": "order_date"
},
"datafeed_config":{
"datafeed_id": "datafeed-ecommerce-geo",
"indices": ["kibana_sample_data_ecommerce"],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
]
}
}
}
}
```
3. View the job results
### Additional information
- This job config was used to create screenshots for the docs, e.g. the first one in [this section](https://www.elastic.co/guide/en/machine-learning/master/geographic-anomalies.html#geographic-anomalies-results):

- When looking at the data for `user: jackson`, we can see 114 documents with 113 of them having the same `geoip.location` somewhere near Los Angeles and one of them having a `geoip.location` near New York

- We can also see this by running a high precision geohash grid aggregation:
```
GET kibana_sample_data_ecommerce/_search
{
"query": {
"simple_query_string": {
"query": "jackson",
"fields": ["user"]
}
},
"aggs": {
"locations": {
"geohash_grid": {"field": "geoip.location", "precision": 12}
}
},
"size": 0
}
```
which gives us
```
[...]
"locations" : {
"buckets" : [
{
"key" : "9q5cyr9qukez",
"doc_count" : 113
},
{
"key" : "dr5rs14yejbs",
"doc_count" : 1
}
]
}
```
- So from this data, the originally detected anomaly seems correct.
Guía de contribución
Línea de trabajo
Empieza instalando los datos de muestra de ecommerce de Kibana y ejecutando la configuración documentada del detector de anomalías ecommerce-geo. Inspecciona los resultados del usuario jackson y compáralos con la agregación geohash proporcionada, que muestra una ubicación de New York entre puntos de Los Angeles. Se considera completado cuando se haya establecido si la anomalía ausente es un cambio esperado o una regresión, y se haya identificado el seguimiento necesario.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- cpp
- Área
- machine-learning
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 32/100