Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ML] Add an important note about a gotcha with the delayed data check #104725

Merged
merged 4 commits into from
Jan 25, 2024
Merged

[ML] Add an important note about a gotcha with the delayed data check #104725

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
666b4c0
[ML] Add an important note about a gotcha with the delayed data check
droberts195 Jan 24, 2024
9417ea6
Making text more precise
droberts195 Jan 25, 2024
eb805de
Update docs/reference/ml/anomaly-detection/ml-delayed-data-detection.…
droberts195 Jan 25, 2024
a64b9b8
Minor edits
droberts195 Jan 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/reference/ml/anomaly-detection/ml-delayed-data-detection.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,21 @@ for the periods where these delays occur:
[role="screenshot"]
image::images/ml-annotations.png["Delayed data annotations in the Single Metric Viewer"]

[IMPORTANT]
====
As the `doc_count` from an aggregation is compared with the
bucket results of the job, the delayed data check will not work correctly in the
following cases:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
following cases:
following cases:

* if the datafeed uses aggregations and its `analysis_config` does not have its
`summary_count_field_name` set to `doc_count`,
* if your job is _not_ using aggregations and `summary_count_field_name` is set to
any value.

If the datafeed is using aggregations then it's highly likely that the
`summary_count_field_name` should be set to `doc_count`. If
`summary_count_field_name` is set to any value other than `doc_count`, the
delayed data check for that job must be disabled.
====
There is another tool for visualizing the delayed data on the *Annotations* tab
in the {anomaly-detect} job management page:

Expand Down