Company
Date Published
Author
Rich Collier
Word count
1369
Language
-
Hacker News points
None

Summary

In the context of Elasticsearch v5.5, anomaly detection through Machine Learning in X-Pack is enhanced by integrating with the Alerting feature, also known as Watcher, to notify users of anomalies detected in real-time. This integration is facilitated by an easy-to-use option that allows users to create "watches" for ML jobs directly from the user interface, enabling alerts based on defined intervals and anomaly severity thresholds. Users can further customize these watches through the Watcher UI, which supports editing, testing, and simulating alerts. The interaction between ML and Alerting is flexible, with capabilities to create custom watches using Elasticsearch indices or the ML results API, giving users the option to target different levels of anomaly data (bucket, record, or influencer). The article emphasizes maintaining appropriate time intervals for watches to ensure anomalies are captured effectively, and it provides insights into the creation and management of watches, noting the importance of considering factors like interval settings and throttle periods to avoid missing or duplicating alerts.