elastic / elastic/ml-cpp

[ML] lat_long anomaly not detected anymore

Abierto
#2,162 0 comentarios 0 reacciones 0 asignados Ver en GitHub
:ml
Lenguaje dominante
C++
Estrellas
157
Forks
67
Merge medio
17 h 52 min
PR fusionados (30 d)
20

Descripción

#### Summary

We used to have a job configuration that produced an anomaly and now it doesn't do that anymore, so we'd like to assess whether or not this is an expected change / a change we want to tolerate.

### Steps to reproduce

1. Install the Kibana ecommerce sample data
2. Create and run the anomaly detection lookback job (synchronize Kibana saved objects if needed)

Config

```
PUT _ml/anomaly_detectors/ecommerce-geo
{
"analysis_config" : {
"bucket_span":"15m",
"detectors": [
{
"detector_description": "Unusual coordinates by user",
"function": "lat_long",
"field_name": "geoip.location",
"by_field_name": "user"
}
],
"influencers": [
"geoip.country_iso_code",
"day_of_week",
"category.keyword",
"user"
]
},
"data_description" : {
"time_field": "order_date"
},
"datafeed_config":{
"datafeed_id": "datafeed-ecommerce-geo",
"indices": ["kibana_sample_data_ecommerce"],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
]
}
}
}
}
```

3. View the job results

### Additional information

- This job config was used to create screenshots for the docs, e.g. the first one in [this section](https://www.elastic.co/guide/en/machine-learning/master/geographic-anomalies.html#geographic-anomalies-results):
![image](https://user-images.githubusercontent.com/1945390/146507541-91e7deb7-5278-4cfc-b49b-34312d2aabde.png)
- When looking at the data for `user: jackson`, we can see 114 documents with 113 of them having the same `geoip.location` somewhere near Los Angeles and one of them having a `geoip.location` near New York
![image](https://user-images.githubusercontent.com/1945390/146509077-a74b6a84-894c-43bc-bdc3-4c98e874cc96.png)
- We can also see this by running a high precision geohash grid aggregation:
```
GET kibana_sample_data_ecommerce/_search
{
"query": {
"simple_query_string": {
"query": "jackson",
"fields": ["user"]
}
},
"aggs": {
"locations": {
"geohash_grid": {"field": "geoip.location", "precision": 12}
}
},
"size": 0
}
```
which gives us
```
[...]
"locations" : {
"buckets" : [
{
"key" : "9q5cyr9qukez",
"doc_count" : 113
},
{
"key" : "dr5rs14yejbs",
"doc_count" : 1
}
]
}
```
- So from this data, the originally detected anomaly seems correct.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Empieza instalando los datos de muestra de ecommerce de Kibana y ejecutando la configuración documentada del detector de anomalías ecommerce-geo. Inspecciona los resultados del usuario jackson y compáralos con la agregación geohash proporcionada, que muestra una ubicación de New York entre puntos de Los Angeles. Se considera completado cuando se haya establecido si la anomalía ausente es un cambio esperado o una regresión, y se haya identificado el seguimiento necesario.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
cpp
Área
machine-learning
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
32/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.