Chapter 3: Anomaly Detection

Anomaly detection was the original capability of Elastic ML and is the most mature, stretching its roots back to the Prelert days (before the acquisition by Elastic in 2016). This technology is robust, easy to use, powerful, and broadly applicable to all kinds of use cases for time series data.

This jam-packed chapter will focus on using Elastic ML to detect anomalies in the occurrence rates of documents/events, rare occurrences of things, and numerical values outside of expected normal operation. We will run through some simple but effective examples that will highlight both the efficacy of Elastic ML and its ease of use.

Specifically, we will cover the following:

• Elastic ML job types
• Dissecting the detector
• Detecting changes in event rates
• Detecting changes in metric values
• Understanding the advanced detector functions
• Splitting analysis along categorical features
• Understanding temporal versus population analysis
...