honeymoose/OpenSearch
1
0
Fork 0
mirror of https://github.com/honeymoose/OpenSearch.git synced 2025-03-25 01:19:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

[DOCS] Makes clearer the note under freq_rare. (#45193)

Browse Source
This commit is contained in:
István Zoltán Szabó 2019-08-05 13:28:22 +02:00
parent 13a167051f
commit dae648eb32
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/reference/ml/anomaly-detection/functions/rare.asciidoc
View File

@ -129,7 +129,9 @@ one or more rare URI paths many times compared to the population is regarded as
highly anomalous. This analysis is based on the count of interactions with rare
URI paths, not the number of different URI path values.
NOTE: To define a URI path as rare, the analytics consider the number of
distinct values that occur and not the number of times the URI path occurs.
If a single client IP visits a single unique URI path, this is rare, even if it
NOTE: Defining a URI path as rare happens the same way as you can see in the
case of the status codes above: the analytics consider the number of distinct
values that occur and not the number of times the URI path occurs. If a single
client IP visits a single unique URI path, this is rare, even if it
occurs for that client IP in every bucket.