Class Anomaly
java.lang.Object
co.elastic.clients.elasticsearch.ml.Anomaly
- All Implemented Interfaces:
JsonpSerializable
- See Also:
-
Nested Class Summary
-
Field Summary
Modifier and TypeFieldDescriptionstatic final JsonpDeserializer<Anomaly>
Json deserializer forAnomaly
-
Method Summary
Modifier and TypeMethodDescriptionactual()
The actual value for the bucket.final AnomalyExplanation
Information about the factors impacting the initial anomaly score.final long
Required - The length of the bucket in seconds.final String
The field used to split the data.final String
The value ofby_field_name
.final List<AnomalyCause>
causes()
For population analysis, an over field must be specified in the detector.final int
Required - A unique identifier for the detector.final String
Certain functions require a field to operate on, for example,sum()
.final String
function()
The function in which the anomaly occurs, as specified in the detector configuration.final String
The description of the function in which the anomaly occurs, as specified in the detector configuration.final GeoResults
If the detector function islat_long
, this object contains comma delimited strings for the latitude and longitude of the actual and typical values.If influencers were specified in the detector configuration, this array contains influencers that contributed to or were to blame for an anomaly.final double
Required - A normalized score between 0-100, which is based on the probability of the anomalousness of this record.final boolean
Required - If true, this is an interim result.final String
jobId()
Required - Identifier for the anomaly detection job.static Anomaly
final String
The field used to split the data.final String
The value ofover_field_name
.final String
The field used to segment the analysis.final String
The value ofpartition_field_name
.final double
Required - The probability of the individual anomaly occurring, in the range 0 to 1.final double
Required - A normalized score between 0-100, which is based on the probability of the anomalousness of this record.final String
Required - Internal.void
serialize
(jakarta.json.stream.JsonGenerator generator, JsonpMapper mapper) Serialize this object to JSON.protected void
serializeInternal
(jakarta.json.stream.JsonGenerator generator, JsonpMapper mapper) protected static void
final long
Required - The start time of the bucket for which these results were calculated.toString()
typical()
The typical value for the bucket, according to analytical modeling.
-
Field Details
-
_DESERIALIZER
Json deserializer forAnomaly
-
-
Method Details
-
of
-
actual
The actual value for the bucket.API name:
actual
-
anomalyScoreExplanation
Information about the factors impacting the initial anomaly score.API name:
anomaly_score_explanation
-
bucketSpan
public final long bucketSpan()Required - The length of the bucket in seconds. This value matches thebucket_span
that is specified in the job.API name:
bucket_span
-
byFieldName
The field used to split the data. In particular, this property is used for analyzing the splits with respect to their own history. It is used for finding unusual values in the context of the split.API name:
by_field_name
-
byFieldValue
The value ofby_field_name
.API name:
by_field_value
-
causes
For population analysis, an over field must be specified in the detector. This property contains an array of anomaly records that are the causes for the anomaly that has been identified for the over field. This sub-resource contains the most anomalous records for theover_field_name
. For scalability reasons, a maximum of the 10 most significant causes of the anomaly are returned. As part of the core analytical modeling, these low-level anomaly records are aggregated for their parent over field record. Thecauses
resource contains similar elements to the record resource, namelyactual
,typical
,geo_results.actual_point
,geo_results.typical_point
,*_field_name
and*_field_value
. Probability and scores are not applicable to causes.API name:
causes
-
detectorIndex
public final int detectorIndex()Required - A unique identifier for the detector.API name:
detector_index
-
fieldName
Certain functions require a field to operate on, for example,sum()
. For those functions, this value is the name of the field to be analyzed.API name:
field_name
-
function
The function in which the anomaly occurs, as specified in the detector configuration. For example,max
.API name:
function
-
functionDescription
The description of the function in which the anomaly occurs, as specified in the detector configuration.API name:
function_description
-
geoResults
If the detector function islat_long
, this object contains comma delimited strings for the latitude and longitude of the actual and typical values.API name:
geo_results
-
influencers
If influencers were specified in the detector configuration, this array contains influencers that contributed to or were to blame for an anomaly.API name:
influencers
-
initialRecordScore
public final double initialRecordScore()Required - A normalized score between 0-100, which is based on the probability of the anomalousness of this record. This is the initial value that was calculated at the time the bucket was processed.API name:
initial_record_score
-
isInterim
public final boolean isInterim()Required - If true, this is an interim result. In other words, the results are calculated based on partial input data.API name:
is_interim
-
jobId
Required - Identifier for the anomaly detection job.API name:
job_id
-
overFieldName
The field used to split the data. In particular, this property is used for analyzing the splits with respect to the history of all splits. It is used for finding unusual values in the population of all splits.API name:
over_field_name
-
overFieldValue
The value ofover_field_name
.API name:
over_field_value
-
partitionFieldName
The field used to segment the analysis. When you use this property, you have completely independent baselines for each value of this field.API name:
partition_field_name
-
partitionFieldValue
The value ofpartition_field_name
.API name:
partition_field_value
-
probability
public final double probability()Required - The probability of the individual anomaly occurring, in the range 0 to 1. For example,0.0000772031
. This value can be held to a high precision of over 300 decimal places, so therecord_score
is provided as a human-readable and friendly interpretation of this.API name:
probability
-
recordScore
public final double recordScore()Required - A normalized score between 0-100, which is based on the probability of the anomalousness of this record. Unlikeinitial_record_score
, this value will be updated by a re-normalization process as new data is analyzed.API name:
record_score
-
resultType
Required - Internal. This is always set torecord
.API name:
result_type
-
timestamp
public final long timestamp()Required - The start time of the bucket for which these results were calculated.API name:
timestamp
-
typical
The typical value for the bucket, according to analytical modeling.API name:
typical
-
serialize
Serialize this object to JSON.- Specified by:
serialize
in interfaceJsonpSerializable
-
serializeInternal
-
toString
-
setupAnomalyDeserializer
-