[ML] lat_long anomaly not detected anymore
- 主要言語
- C++
- スター
- 157
- フォーク
- 67
- 平均マージ
- 17時間 52分
- マージ済み PR(30日)
- 20
説明
#### Summary
We used to have a job configuration that produced an anomaly and now it doesn't do that anymore, so we'd like to assess whether or not this is an expected change / a change we want to tolerate.
### Steps to reproduce
1. Install the Kibana ecommerce sample data
2. Create and run the anomaly detection lookback job (synchronize Kibana saved objects if needed)
Config
```
PUT _ml/anomaly_detectors/ecommerce-geo
{
"analysis_config" : {
"bucket_span":"15m",
"detectors": [
{
"detector_description": "Unusual coordinates by user",
"function": "lat_long",
"field_name": "geoip.location",
"by_field_name": "user"
}
],
"influencers": [
"geoip.country_iso_code",
"day_of_week",
"category.keyword",
"user"
]
},
"data_description" : {
"time_field": "order_date"
},
"datafeed_config":{
"datafeed_id": "datafeed-ecommerce-geo",
"indices": ["kibana_sample_data_ecommerce"],
"query": {
"bool": {
"must": [
{
"match_all": {}
}
]
}
}
}
}
```
3. View the job results
### Additional information
- This job config was used to create screenshots for the docs, e.g. the first one in [this section](https://www.elastic.co/guide/en/machine-learning/master/geographic-anomalies.html#geographic-anomalies-results):

- When looking at the data for `user: jackson`, we can see 114 documents with 113 of them having the same `geoip.location` somewhere near Los Angeles and one of them having a `geoip.location` near New York

- We can also see this by running a high precision geohash grid aggregation:
```
GET kibana_sample_data_ecommerce/_search
{
"query": {
"simple_query_string": {
"query": "jackson",
"fields": ["user"]
}
},
"aggs": {
"locations": {
"geohash_grid": {"field": "geoip.location", "precision": 12}
}
},
"size": 0
}
```
which gives us
```
[...]
"locations" : {
"buckets" : [
{
"key" : "9q5cyr9qukez",
"doc_count" : 113
},
{
"key" : "dr5rs14yejbs",
"doc_count" : 1
}
]
}
```
- So from this data, the originally detected anomaly seems correct.
コントリビューションガイド
調査の方向性
まず Kibana の ecommerce サンプルデータをインストールし、文書化された ecommerce-geo 異常検出器の設定を実行します。ユーザー jackson の結果を調査し、Los Angeles のポイントの中に New York の位置が 1 つあることを示す、提供された geohash 集約と比較します。欠落している異常が想定された変更なのかリグレッションなのかを明らかにし、必要なフォローアップを特定できれば完了です。
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- cpp
- 領域
- machine-learning
- issue の種類
- バグ
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 32/100