diff --git a/docs/reference/ml/anomaly-detection/populations.asciidoc b/docs/reference/ml/anomaly-detection/populations.asciidoc index decbe6a3b35..7df0d2ffbc2 100644 --- a/docs/reference/ml/anomaly-detection/populations.asciidoc +++ b/docs/reference/ml/anomaly-detection/populations.asciidoc @@ -62,26 +62,26 @@ the sample web logs in {kib}, you can use the following job settings in the population job wizard: [role="screenshot"] -image::images/ml-population-job.jpg["Job settings in the population job wizard] +image::images/ml-population-job.png["Job settings in the population job wizard] After you open the job and start the {dfeed} or supply data to the job, you can view the results in {kib}. For example, you can view the results in the **Anomaly Explorer**: [role="screenshot"] -image::images/ml-population-results.jpg["Population analysis results in the Anomaly Explorer"] +image::images/ml-population-results.png["Population analysis results in the Anomaly Explorer"] As in this case, the results are often quite sparse. There might be just a few data points for the selected time period. Population analysis is particularly useful when you have many entities and the data for specific entitles is sporadic or sparse. -If you click on a section in the timeline or swimlanes, you can see more +If you click on a section in the timeline or swim lanes, you can see more details about the anomalies: [role="screenshot"] -image::images/ml-population-anomaly.jpg["Anomaly details for a specific user"] +image::images/ml-population-anomaly.png["Anomaly details for a specific user"] -In this example, the client IP address `29.64.62.83` received a high volume of +In this example, the client IP address `30.156.16.164` received a low volume of bytes on the date and time shown. This event is anomalous because the mean is -three times higher than the expected behavior of the population. +three times lower than the expected behavior of the population. diff --git a/docs/reference/ml/images/ml-population-anomaly.jpg b/docs/reference/ml/images/ml-population-anomaly.jpg deleted file mode 100644 index 64a2d7a52b6..00000000000 Binary files a/docs/reference/ml/images/ml-population-anomaly.jpg and /dev/null differ diff --git a/docs/reference/ml/images/ml-population-anomaly.png b/docs/reference/ml/images/ml-population-anomaly.png new file mode 100644 index 00000000000..e2a05733f50 Binary files /dev/null and b/docs/reference/ml/images/ml-population-anomaly.png differ diff --git a/docs/reference/ml/images/ml-population-job.jpg b/docs/reference/ml/images/ml-population-job.jpg deleted file mode 100644 index 476561b90bd..00000000000 Binary files a/docs/reference/ml/images/ml-population-job.jpg and /dev/null differ diff --git a/docs/reference/ml/images/ml-population-job.png b/docs/reference/ml/images/ml-population-job.png new file mode 100644 index 00000000000..bab15230214 Binary files /dev/null and b/docs/reference/ml/images/ml-population-job.png differ diff --git a/docs/reference/ml/images/ml-population-results.jpg b/docs/reference/ml/images/ml-population-results.jpg deleted file mode 100644 index 7bf4c1d8de9..00000000000 Binary files a/docs/reference/ml/images/ml-population-results.jpg and /dev/null differ diff --git a/docs/reference/ml/images/ml-population-results.png b/docs/reference/ml/images/ml-population-results.png new file mode 100644 index 00000000000..fcf842ea1d1 Binary files /dev/null and b/docs/reference/ml/images/ml-population-results.png differ