You're reading from Machine Learning with the Elastic Stack Gain valuable insights from your data with Elastic Stack's machine learning features

Product type Paperback

Published in May 2021

Publisher Packt

ISBN-13 9781801070034

Length 450 pages

Edition 2nd Edition

Languages

Python

Tools

Elasticsearch

Concepts

Machine Learning

Authors (3):

Camilla Montonen

Rich Collier

Bahaaldine Azarmi

View More author details

Table of Contents (19) Chapters

Preface

1. Section 1 – Getting Started with Machine Learning with Elastic Stack

2. Chapter 1: Machine Learning for IT FREE CHAPTER

3. Chapter 2: Enabling and Operationalization

4. Section 2 – Time Series Analysis – Anomaly Detection and Forecasting

5. Chapter 3: Anomaly Detection

6. Chapter 4: Forecasting

7. Chapter 5: Interpreting Results

8. Chapter 6: Alerting on ML Analysis

9. Chapter 7: AIOps and Root Cause Analysis

10. Chapter 8: Anomaly Detection in Other Elastic Stack Apps

11. Section 3 – Data Frame Analysis

12. Chapter 9: Introducing Data Frame Analytics

13. Chapter 10: Outlier Detection

14. Chapter 11: Classification Analysis

15. Chapter 12: Regression

16. Chapter 13: Inference

17. Other Books You May Enjoy

Appendix: Anomaly Detection Tips

Using anomaly detection on runtime fields

In some cases, it might be necessary to analyze the value of a field that doesn't exist in the index mappings but can be calculated dynamically from other field values. This capability to dynamically define field values has existed for quite some time in Elasticsearch as script fields, but starting in v7.11, script fields are replaced by an updated concept known as runtime fields. In short, runtime fields are treated like first-class citizens in the Elasticsearch mapping (if defined there) and will eventually allow the user to promote a runtime field into an indexed field.

Users can define runtime fields in the mapping or only in the search request. It is good to note that at the time of writing, there is no support for definitions of runtime fields in the data feed of an anomaly detection job. However, if the runtime fields are defined in the mappings, then the anomaly detection job can leverage them seamlessly.

Note

For more...