18
18
(object) You can specify both `includes` and/or `excludes` patterns. If
19
19
`analyzed_fields` is not set, only the relevant fields will be included. For
20
20
example all the numeric fields for {oldetection}.
21
+
22
+ [source,js]
23
+ --------------------------------------------------
24
+ PUT _ml/data_frame/analytics/loganalytics
25
+ {
26
+ "source": {
27
+ "index": "logdata"
28
+ },
29
+ "dest": {
30
+ "index": "logdata_out"
31
+ },
32
+ "analysis": {
33
+ "outlier_detection": {
34
+ }
35
+ },
36
+ "analyzed_fields": {
37
+ "includes": [ "request.bytes", "response.counts.error" ],
38
+ "excludes": [ "source.geo" ]
39
+ }
40
+ }
41
+ --------------------------------------------------
42
+ // CONSOLE
43
+ // TEST[setup:setup_logdata]
21
44
22
45
`dest`::
23
- (object) The destination configuration of the analysis. For more information,
24
- see <<dfanalytics-dest-resources>>.
46
+ (object) The destination configuration of the analysis. The `index` property
47
+ (string) is the name of the index in which to store the results of the
48
+ {dfanalytics-job}. The `results_field` (string) property defines the name of
49
+ the field in which to store the results of the analysis. The default value is
50
+ `ml`.
25
51
26
52
`id`::
27
53
(string) The unique identifier for the {dfanalytics-job}. This identifier can
38
64
that setting. For more information, see <<ml-settings>>.
39
65
40
66
`source`::
41
- (object) The source configuration, consisting of `index` and optionally a
42
- `query`. For more information, see <<dfanalytics-source-resources>>.
67
+ (object) The source configuration, consisting of `index` (array) which is an
68
+ array of index names on which to perform the analysis. It can be a single
69
+ index or index pattern as well as an array of indices or patterns. Optionally,
70
+ `source` can have a `query` (object) property. The {es} query domain-specific
71
+ language (DSL). This value corresponds to the query object in an {es} search
72
+ POST body. All the options that are supported by {es} can be used, as this
73
+ object is passed verbatim to {es}. By default, this property has the following
74
+ value: `{"match_all": {}}`.
43
75
44
76
[[dfanalytics-types]]
45
77
==== Analysis objects
46
78
47
79
{dfanalytics-cap} resources contain `analysis` objects. For example, when you
48
- create a {dfanalytics-job}, you must define the type of analysis it performs.
80
+ create a {dfanalytics-job}, you must define the type of analysis it performs.
81
+ Currently, `outlier_detection` is the only available type of analysis, however,
82
+ other types will be added, for example `regression`.
49
83
50
84
[discrete]
51
85
[[oldetection-resources]]
52
- ===== {oldetection-cap} configuration objects
86
+ ==== {oldetection-cap} configuration objects
53
87
54
88
An {oldetection} configuration object has the following properties:
55
89
56
- [discrete]
57
- [[oldetection-properties]]
58
- ==== {api-definitions-title}
59
-
60
90
`n_neighbors`::
61
91
(integer) Defines the value for how many nearest neighbors each method of
62
92
{oldetection} will use to calculate its {olscore}. When the value is
@@ -65,44 +95,11 @@ An {oldetection} configuration object has the following properties:
65
95
`method`::
66
96
(string) Sets the method that {oldetection} uses. If the method is not set
67
97
{oldetection} uses an ensemble of different methods and normalises and
68
- combines their individual {olscores} to obtain the overall {olscore}.
69
- Available methods are `lof`, `ldof`, `distance_kth_nn`, `distance_knn`.
98
+ combines their individual {olscores} to obtain the overall {olscore}. We
99
+ recommend to use the ensemble method. Available methods are `lof`, `ldof`,
100
+ `distance_kth_nn`, `distance_knn`.
70
101
71
102
`feature_influence_threshold`::
72
103
(double) The minimum {olscore} that a document needs to have in order to
73
104
calculate its {fiscore}.
74
- Value range: 0-1 (`0.1` by default).
75
-
76
- [[dfanalytics-dest-resources]]
77
- ==== Dest configuration objects
78
-
79
- {dfanalytics-cap} resources contain `dest` objects. For example, when you
80
- create a {dfanalytics-job}, you must define its destination.
81
-
82
- [discrete]
83
- [[dfanalytics-dest-properties]]
84
- ==== {api-definitions-title}
85
-
86
- `index`::
87
- (string) The name of the index in which to store the results of the
88
- {dfanalytics-job}.
89
-
90
- `results_field`::
91
- (string) The name of the field in which to store the results of the analysis.
92
- The default value is `ml`.
93
-
94
- [[dfanalytics-source-resources]]
95
- ==== Source configuration objects
96
-
97
- The `source` configuration object has the following properties:
98
-
99
- `index`::
100
- (array) An array of index names on which to perform the analysis. It can be a
101
- single index or index pattern as well as an array of indices or patterns.
102
-
103
- `query`::
104
- (object) The {es} query domain-specific language (DSL). This value
105
- corresponds to the query object in an {es} search POST body. All the
106
- options that are supported by {es} can be used, as this object is
107
- passed verbatim to {es}. By default, this property has the following
108
- value: `{"match_all": {}}`.
105
+ Value range: 0-1 (`0.1` by default).
0 commit comments