2017-12-08 12:07:14 -05:00
|
|
|
[[ml-buckets]]
|
|
|
|
|
=== Buckets
|
2018-01-22 16:52:47 -05:00
|
|
|
++++
|
|
|
|
|
<titleabbrev>Buckets</titleabbrev>
|
|
|
|
|
++++
|
2017-12-08 12:07:14 -05:00
|
|
|
|
2018-01-22 16:52:47 -05:00
|
|
|
The {xpackml} features use the concept of a _bucket_ to divide the time series
|
|
|
|
|
into batches for processing.
|
|
|
|
|
|
|
|
|
|
The _bucket span_ is part of the configuration information for a job. It defines
|
|
|
|
|
the time interval that is used to summarize and model the data. This is
|
|
|
|
|
typically between 5 minutes to 1 hour and it depends on your data characteristics.
|
|
|
|
|
When you set the bucket span, take into account the granularity at which you
|
|
|
|
|
want to analyze, the frequency of the input data, the typical duration of the
|
|
|
|
|
anomalies, and the frequency at which alerting is required.
|
|
|
|
|
|
|
|
|
|
When you view your {ml} results, each bucket has an anomaly score. This score is
|
|
|
|
|
a statistically aggregated and normalized view of the combined anomalousness of
|
|
|
|
|
all the record results in the bucket. If you have more than one job, you can
|
|
|
|
|
also obtain overall bucket results, which combine and correlate anomalies from
|
|
|
|
|
multiple jobs into an overall score. When you view the results for jobs groups
|
|
|
|
|
in {kib}, it provides the overall bucket scores.
|
|
|
|
|
|
|
|
|
|
For more information, see
|
|
|
|
|
{ref}/ml-results-resource.html[Results Resources] and
|
|
|
|
|
{ref}/ml-get-overall-buckets.html[Get Overall Buckets API].
|
