41 lines
1.8 KiB
Plaintext
41 lines
1.8 KiB
Plaintext
[[ml-calendars]]
|
|
=== Calendars and Scheduled Events
|
|
|
|
Sometimes there are periods when you expect unusual activity to take place,
|
|
such as bank holidays, "Black Friday", or planned system outages. If you
|
|
identify these events in advance, no anomalies are generated during that period.
|
|
The {ml} model is not ill-affected and you do not receive spurious results.
|
|
|
|
You can create calendars and scheduled events in the **Settings** pane on the
|
|
**Machine Learning** page in {kib} or by using {ref}/ml-apis.html[{ml} APIs].
|
|
|
|
A scheduled event must have a start time, end time, and description. In general,
|
|
scheduled events are short in duration (typically lasting from a few hours to a
|
|
day) and occur infrequently. If you have regularly occurring events, such as
|
|
weekly maintenance periods, you do not need to create scheduled events for these
|
|
circumstances; they are already handled by the {ml} analytics.
|
|
|
|
You can identify zero or more scheduled events in a calendar. Jobs can then
|
|
subscribe to calendars and the {ml} analytics handle all subsequent scheduled
|
|
events appropriately.
|
|
|
|
If you want to add multiple scheduled events at once, you can import an
|
|
iCalendar (`.ics`) file in {kib} or a JSON file in the
|
|
{ref}/ml-post-calendar-event.html[add events to calendar API].
|
|
|
|
[NOTE]
|
|
--
|
|
|
|
* You must identify scheduled events before your job analyzes the data for that
|
|
time period. Machine learning results are not updated retroactively.
|
|
* If your iCalendar file contains recurring events, only the first occurrence is
|
|
imported.
|
|
* Bucket results are generated during scheduled events but they have an
|
|
anomaly score of zero. For more information about bucket results, see
|
|
{ref}/ml-results-resource.html[Results Resources].
|
|
* If you use long or frequent scheduled events, it might take longer for the
|
|
{ml} analytics to learn to model your data and some anomalous behavior might be
|
|
missed.
|
|
|
|
--
|