mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-06-30 10:23:41 -04:00
82 lines
3.7 KiB
Text
82 lines
3.7 KiB
Text
[role="xpack"]
|
|
[[ml-configuring-alerts]]
|
|
= Configuring {anomaly-detect} alerts
|
|
|
|
beta::[]
|
|
|
|
{anomaly-detect-cap} alerts run scheduled checks on an {anomaly-job} or a group
|
|
of jobs to detect anomalies with certain conditions. If an anomaly meets the
|
|
conditions, the alert triggers the defined action. For example, you can create
|
|
an alert that checks an {anomaly-job} every fifteen minutes for critical
|
|
anomalies and notifies you in an email. This page helps you to configure an
|
|
{anomaly-detect} alert. To learn more about alerts in the {stack}, refer to
|
|
{kibana-ref}/alerting-getting-started.html#alerting-getting-started[Alerting and Actions].
|
|
|
|
|
|
[[creating-anomaly-alerts]]
|
|
== Creating an alert
|
|
|
|
You can create {anomaly-detect} alerts in the {anomaly-job} wizard after you
|
|
start the job, from the job list, or under **{stack-manage-app} >
|
|
{alerts-ui}**. On the *Create alert* window, select *{anomaly-detect-cap} alert*
|
|
under the {ml-cap} section, then give a name to the alert and optionally provide
|
|
tags.
|
|
|
|
Specify the time interval for the alert to check detected anomalies. It is
|
|
recommended to select an interval that is close to the bucket span of the
|
|
associated job. You can also select a notification option by using the _Notify_
|
|
selector. For more details, refer to the documentation of
|
|
{kibana-ref}/defining-alerts.html#defining-alerts-general-details[general alert details].
|
|
|
|
NOTE: {anomaly-detect-cap} alerts handle duplications. If you set an interval
|
|
that makes the alert check the same bucket multiple times and the bucket
|
|
contains an anomaly that meets the alert conditions, the configured action
|
|
is triggered only once.
|
|
|
|
[role="screenshot"]
|
|
image::images/ml-anomaly-alert-type.jpg["Creating an anomaly detection alert"]
|
|
|
|
Select the {anomaly-job} or the group of {anomaly-jobs} that is checked by the
|
|
alert. If you assign additional jobs to the group, the alert automatically
|
|
checks the new jobs the next time when the alert runs.
|
|
|
|
You can select the result type of the {anomaly-job} that triggers the alert.
|
|
In particular, you can create alerts based on bucket, record, or influencer
|
|
results.
|
|
|
|
[role="screenshot"]
|
|
image::images/ml-anomaly-alert-severity.jpg["Selecting result type, severity, and test interval"]
|
|
|
|
For each alert, you can configure the `anomaly_score` that triggers it. The
|
|
`anomaly_score` indicates the significance of a given anomaly compared to
|
|
previous anomalies. The default severity threshold is 75 which means every
|
|
anomaly with an `anomaly_score` of 75 or higher triggers the alert.
|
|
|
|
You can also test the configured conditions against your existing data and check
|
|
the sample results by providing a valid interval for your data. The generated
|
|
preview contains the number of potentially created alert instances during the
|
|
relative time range you defined.
|
|
|
|
|
|
[[defining-actions]]
|
|
== Defining actions
|
|
|
|
As a next step, connect your alert to actions that use supported built-in
|
|
integrations. Actions are {kib} services or third-party integrations that run
|
|
when the alert conditions are met.
|
|
|
|
[role="screenshot"]
|
|
image::images/ml-anomaly-alert-actions.jpg["Selecting action type"]
|
|
|
|
For example, you can choose _Slack_ as an action type and configure it to send a
|
|
message to a channel you selected. You can also create an index connector that
|
|
writes the JSON object you configure to a specific index. It's also possible to
|
|
customize the notification messages. A list of variables is available to include
|
|
in the message, like job ID, anomaly score, time, or top influencers.
|
|
|
|
[role="screenshot"]
|
|
image::images/ml-anomaly-alert-messages.jpg["Customizing your message"]
|
|
|
|
After you save the configurations, the alert appears in the _Alerts and
|
|
Actions_ list where you can check its status and see the overview of its
|
|
configuration information.
|