AD chapter fixes

docs/ad/api.md

@@ -446,7 +446,7 @@ If you specify a category field, each result is associated with an entity:
 
 ## Start detector job
 
-Starts a real-time or historical detector job.
+Starts a real-time or historical anomaly detector job.
 
 
 #### Request
@@ -589,7 +589,8 @@ POST _opensearch/_anomaly_detection/detectors/results/_search
 }
 ```
 
-In high cardinality detectors, the result contains entities’ information.
+In high cardinality detectors, the result contains entity information.
+
 To see an ordered set of anomaly records for an entity with an anomaly within a certain time range for a specific feature value:
 
 #### Request
@@ -1976,9 +1977,9 @@ GET _opensearch/_anomaly_detection/detectors/<detectorId>/_profile/total_size_in
 }
 ```
 
-If you have configured the category field, you can see the number of unique values in the field and also all the active entities with models running in memory.
+If you configured the category field, you can see the number of unique values in the field and all active entities with models running in memory.
-You can use this data to estimate the memory required for anomaly detection to help decide the size of your cluster.
+
-For example, if a detector has one million entities and only 10 of them are active in memory, then you need to scale up or scale out your cluster.
+You can use this data to estimate how much memory is required for anomaly detection so you can decide how to size your cluster. For example, if a detector has one million entities and only 10 of them are active in memory, you need to scale your cluster up or out.
 
 #### Request
 
@@ -2035,7 +2036,7 @@ GET /_opensearch/_anomaly_detection/detectors/<detectorId>/_profile?_all=true&pr
 
 The `profile` operation also provides information about each entity, such as the entity’s `last_sample_timestamp` and `last_active_timestamp`.
 
-No anomaly results for an entity indicates that either the entity doesn't have any sample data or its model is removed from the model cache.
+If there are no anomaly results for an entity, either the entity doesn't have any sample data or its model is removed from the model cache.
 
  `last_sample_timestamp` shows the last document in the input data source index containing the entity, while `last_active_timestamp` shows the timestamp when the entity’s model was last seen in the model cache.
 

docs/ad/index.md

@@ -7,11 +7,11 @@ has_children: true
 
 # Anomaly detection
 
-An anomaly is any unusual change in behavior. Anomalies in your time-series data can lead to valuable insights. For example, for IT infrastructure data, an anomaly in the memory usage metric might help you uncover early signs of a system failure.
+An anomaly in OpenSearch is any unusual behavior change in your time-series data. Anomalies can provide valuable insights into your data. For example, for IT infrastructure data, an anomaly in the memory usage metric might help you uncover early signs of a system failure.
 
-Discovering anomalies using conventional methods such as creating visualizations and dashboards can be challenging. You can set an alert based on a static threshold, but this requires prior domain knowledge and is not adaptive to data that exhibits organic growth or seasonal behavior.
+It can be challenging to discover anomalies using conventional methods such as creating visualizations and dashboards. You could configure an alert based on a static threshold, but this requires prior domain knowledge and isn't adaptive to data that exhibits organic growth or seasonal behavior.
 
-The anomaly detection feature automatically detects anomalies in your OpenSearch data in near real-time using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream to compute an `anomaly grade` and `confidence score` value for each incoming data point. These values are used to differentiate an anomaly from normal variations. For more information about how RCF works, see [Random Cut Forests](https://pdfs.semanticscholar.org/8bba/52e9797f2e2cc9a823dbd12514d02f29c8b9.pdf?_ga=2.56302955.1913766445.1574109076-1059151610.1574109076).
+Anomaly detection  automatically detects anomalies in your OpenSearch data in near real-time using the Random Cut Forest (RCF) algorithm. RCF is an unsupervised machine learning algorithm that models a sketch of your incoming data stream to compute an `anomaly grade` and `confidence score` value for each incoming data point. These values are used to differentiate an anomaly from normal variations. For more information about how RCF works, see [Random Cut Forests](https://pdfs.semanticscholar.org/8bba/52e9797f2e2cc9a823dbd12514d02f29c8b9.pdf?_ga=2.56302955.1913766445.1574109076-1059151610.1574109076).
 
 You can pair the anomaly detection plugin with the [alerting plugin](../alerting/) to notify you as soon as an anomaly is detected.
 
@@ -28,27 +28,27 @@ To first test with sample streaming data, choose **Sample Detectors** and try ou
 A detector is an individual anomaly detection task. You can create multiple detectors, and all the detectors can run simultaneously, with each analyzing data from different sources.
 
 1. Choose **Create Detector**.
-1. Enter the **Name** of the detector and a brief **Description**. Make sure the name that you enter is unique and descriptive enough to help you to identify the purpose of this detector.
+1. Enter a name and brief description. Make sure the name is unique and descriptive enough to help you to identify the purpose of the detector.
-1. For **Data source**, choose the index that you want to use as the data source. You can optionally use index patterns to choose multiple indices.
+1. For **Data source**, choose the index you want to use as the data source. You can optionally use index patterns to choose multiple indices.
-1. Choose the **Timestamp field** in your index.
+1. Select the **Timestamp field** in your index.
-1. For **Data filter**, you can optionally filter the index that you chose as the data source. From the **Filter type** menu, choose  **Visual filter**, and then design your filter query by selecting **Fields**, **Operator**, and **Value**, or choose **Custom Expression** and add in your own JSON filter query.
+1. (Optional) For **Data filter**, filter the index you chose as the data source. From the **Filter type** menu, choose  **Visual filter**, and then design your filter query by selecting **Fields**, **Operator**, and **Value**, or choose **Custom Expression** and add your own JSON filter query.
-1. For **Detector operation settings**, define the **Detector interval** to set the time interval at which the detector collects data.
+1. For **Detector operation settings**, define the **Detector interval**, which is the time interval at which the detector collects data.
 - The detector aggregates the data in this interval, then feeds the aggregated result into the anomaly detection model.
 The shorter you set this interval, the fewer data points the detector aggregates.
 The anomaly detection model uses a shingling process, a technique that uses consecutive data points to create a sample for the model. This process needs a certain number of aggregated data points from contiguous intervals.
-- We recommend you set the detector interval based on your actual data. Too long of an interval might delay the results and too short of an interval might miss some data and also not have a sufficient number of consecutive data points for the shingle process.
+- We recommend setting the detector interval based on your actual data. If it's too long it might delay the results, and if it's too short it might miss some data. It also won't have a sufficient number of consecutive data points for the shingle process.
-1. To add extra processing time for data collection, specify a **Window delay** value. This is to tell the detector that the data is not ingested into OpenSearch in real time but with a certain delay.
+1. (Optional) To add extra processing time for data collection, specify a **Window delay** value. This value tells the detector that the data is not ingested into OpenSearch in real time but with a certain delay.
 Set the window delay to shift the detector interval to account for this delay.
 - For example, say the detector interval is 10 minutes and data is ingested into your cluster with a general delay of 1 minute.
-Assume the detector runs at 2:00, the detector attempts to get the last 10 minutes of data from 1:50 to 2:00, but because of the 1-minute delay, it only gets 9 minutes of data and misses the data from 1:59 to 2:00.
+Assume the detector runs at 2:00. The detector attempts to get the last 10 minutes of data from 1:50 to 2:00, but because of the 1-minute delay, it only gets 9 minutes of data and misses the data from 1:59 to 2:00.
-Setting the window delay to 1 minute, shifts the interval window to 1:49 - 1:59, so the detector accounts for all 10 minutes of the detector interval time.
+Setting the window delay to 1 minute shifts the interval window to 1:49 - 1:59, so the detector accounts for all 10 minutes of the detector interval time.
 1. Choose **Create**.
 
 After you create the detector, the next step is to add features to it.
 
 ### Step 2: Add features to your detector
 
-In this case, a feature is the field in your index that you want to check for anomalies. A detector can discover anomalies across one or more features. You must choose an aggregation method for each feature: `average()`, `count()`, `sum()`, `min()`, or `max()`. The aggregation method determines what constitutes an anomaly.
+A feature is the field in your index that you want to check for anomalies. A detector can discover anomalies across one or more features. You must choose an aggregation method for each feature: `average()`, `count()`, `sum()`, `min()`, or `max()`. The aggregation method determines what constitutes an anomaly.
 
 For example, if you choose `min()`, the detector focuses on finding anomalies based on the minimum values of your feature. If you choose `average()`, the detector finds anomalies based on the average values of your feature.
 
@@ -56,7 +56,7 @@ A multi-feature model correlates anomalies across all its features. The [curse o
 {: .note }
 
 1. On the **Model configuration** page, enter the **Feature name**.
-1. For **Find anomalies based on**, choose the method to find anomalies. For **Field Value** menu, choose the **field** and the **aggregation method**. Or choose **Custom expression**, and add in your own JSON aggregation query.
+1. For **Find anomalies based on**, choose the method to find anomalies. For **Field Value** menu, choose the **field** and the **aggregation method**. Or choose **Custom expression**, and add your own JSON aggregation query.
 
 #### (Optional) Set a category field for high cardinality
 
@@ -66,55 +66,56 @@ The category field categorizes or slices the source time series with a dimension
 
 To set a category field, choose **Enable a category field** and select a field.
 
-Only a certain number of unique entities are supported in the category field. Use the following equation to calculate the recommended total number of entities number supported in a cluster:
+Only a certain number of unique entities are supported in the category field. Use the following equation to calculate the recommended total number of entities supported in a cluster:
 
 ```
 (data nodes * heap size * anomaly detection maximum memory percentage) / (entity size of a detector)
 ```
 
-This formula provides a good starting point, test with a representative workload and see how it goes.
+This formula provides a good starting point, but make sure to test with a representative workload.
 {: .note }
 
 For example, for a cluster with 3 data nodes, each with 8G of JVM heap size, a maximum memory percentage of 10% (default), and the entity size of the detector as 1MB: the total number of unique entities supported is (8.096 * 10^9 * 0.1 / 1M ) * 3 = 2429.
 
 #### Set a window size
 
-Set the number of aggregation intervals from your data stream to consider in a detection window. We recommend you choose this value based on your actual data to see which one leads to the best results for your use case.
+Set the number of aggregation intervals from your data stream to consider in a detection window. It's best to choose this value based on your actual data to see which one leads to the best results for your use case.
 
-Based on experiments performed on a wide variety of one-dimensional data streams, we recommend using a window size between 1 and 16. The default window size is 8. If you have set the category field for high cardinality, the default window size is 1.
+Based on experiments performed on a wide variety of one-dimensional data streams, we recommend using a window size between 1 and 16. The default window size is 8. If you set the category field for high cardinality, the default window size is 1.
 
-If you expect missing values in your data or if you want the anomalies based on the current interval, choose 1. If your data is continuously ingested and you want the anomalies based on multiple intervals, choose a larger window size.
+If you expect missing values in your data or if you want to base the anomalies on the current interval, choose 1. If your data is continuously ingested and you want to base the anomalies on multiple intervals, choose a larger window size.
 
 #### Preview sample anomalies
 
 Preview sample anomalies and adjust the feature settings if needed.
 For sample previews, the anomaly detection plugin selects a small number of data samples---for example, one data point every 30 minutes---and uses interpolation to estimate the remaining data points to approximate the actual feature data. It loads this sample dataset into the detector. The detector uses this sample dataset to generate a sample preview of anomaly results.
-Examine the sample preview and use it to fine-tune your feature configurations, for example, enable or disable features, to get more accurate results.
+
+Examine the sample preview and use it to fine-tune your feature configurations (for example, enable or disable features) to get more accurate results.
 
 1. Choose **Save and start detector**.
 1. Choose between automatically starting the detector (recommended) or manually starting the detector at a later time.
 
 ### Step 3: Observe the results
 
-Choose the **Anomaly results** tab.
+Choose the **Anomaly results** tab. You need to wait for some time to see the anomaly results. If the detector interval is 10 minutes, the detector might take more than an hour to start, as it's waiting for sufficient data to generate anomalies.
-
-You will have to wait for some time to see the anomaly results.
-
-If the detector interval is 10 minutes, the detector might take more than an hour to start, as it's waiting for sufficient data to generate anomalies.
 
 A shorter interval means the model passes the shingle process more quickly and starts to generate the anomaly results sooner.
-Use the [profile detector](./api#profile-detector) operation to make sure you check you have sufficient data points.
+Use the [profile detector](./api#profile-detector) operation to make sure you have sufficient data points.
 
-If you see the detector pending in "initialization" for longer than a day, aggregate your existing data using the detector interval to check if for any missing data points. If you find a lot of missing data points from the aggregated data, consider increasing the detector interval.
+If you see the detector pending in "initialization" for longer than a day, aggregate your existing data using the detector interval to check for any missing data points. If you find a lot of missing data points from the aggregated data, consider increasing the detector interval.
 
 ![Anomaly detection results](../images/ad.png)
 
-- The **Live anomalies** chart displays the live anomaly results for the last 60 intervals. For example, if the interval is set to 10, it shows the results for the last 600 minutes. This chart refreshes every 30 seconds.
+Analize anomalies with the following visualizations:
-- The **Anomaly history** chart plots the anomaly grade with the corresponding measure of confidence.
-- The **Feature breakdown** graph plots the features based on the aggregation method. You can vary the date-time range of the detector.
-- The **Anomaly occurrence** table shows the `Start time`, `End time`, `Data confidence`, and `Anomaly grade` for each anomaly detected.
 
-Anomaly grade is a number between 0 and 1 that indicates the level of severity of how anomalous a data point is. An anomaly grade of 0 represents “not an anomaly,” and a non-zero value represents the relative severity of the anomaly. The confidence score is an estimate of the probability that the reported anomaly grade matches the expected anomaly grade. Confidence increases as the model observes more data and learns the data behavior and trends. Note that confidence is distinct from model accuracy.
+- **Live anomalies** - displays live anomaly results for the last 60 intervals. For example, if the interval is 10, it shows results for the last 600 minutes. The chart refreshes every 30 seconds.
+- **Anomaly history** - plots the anomaly grade with the corresponding measure of confidence.
+- **Feature breakdown** - plots the features based on the aggregation method. You can vary the date-time range of the detector.
+- **Anomaly occurrence** - shows the `Start time`, `End time`, `Data confidence`, and `Anomaly grade` for each detected anomaly.
+
+`Anomaly grade` is a number between 0 and 1 that indicates how anomalous a data point is. An anomaly grade of 0 represents “not an anomaly,” and a non-zero value represents the relative severity of the anomaly. 
+
+`Data confidence` is an estimate of the probability that the reported anomaly grade matches the expected anomaly grade. Confidence increases as the model observes more data and learns the data behavior and trends. Note that confidence is distinct from model accuracy.
 
 If you set the category field, you see an additional **Heat map** chart. The heat map correlates results for anomalous entities. This chart is empty until you select an anomalous entity. You also see the anomaly and feature line chart for the time period of the anomaly (`anomaly_grade` > 0).
 
@@ -123,19 +124,16 @@ Choose a filled rectangle to see a more detailed view of the anomaly.
 
 ### Step 4: Set up alerts
 
-To create a monitor to send you notifications when any anomalies are detected, choose **Set up alerts**.
+Choose **Set up alerts** and configure a monitor to notify you when anomalies are detected. For steps to create a monitor and set up notifications based on your anomaly detector, see [Monitors](../alerting/monitors/).
-You're redirected to the **Alerting**, **Add monitor** page.
 
-For steps to create a monitor and set notifications based on your anomaly detector, see [Monitor](../alerting/monitors/).
+If you stop or delete a detector, make sure to delete any monitors associated with it.
-
-If you stop or delete a detector, make sure to delete any monitors associated with the detector.
 
 ### Step 5: Adjust the model
 
-To see all the configuration settings, choose the **Detector configuration** tab.
+To see all the configuration settings for a detector, choose the **Detector configuration** tab.
 
-1. To make any changes to the detector configuration, or fine tune the time interval to minimize any false positives, in the **Detector configuration** section, choose **Edit**.
+1. To make any changes to the detector configuration, or fine tune the time interval to minimize any false positives, go to the **Detector configuration** section and choose **Edit**.
-- You need to stop the detector to change the detector configuration. In the pop-up box, confirm that you want to stop the detector and proceed.
+- You need to stop the detector to change its configuration. Confirm that you want to stop the detector and proceed.
 1. To enable or disable features, in the **Features** section, choose **Edit** and adjust the feature settings as needed. After you make your changes, choose **Save and start detector**.
 - Choose between automatically starting the detector (recommended) or manually starting the detector at a later time.
 
@@ -143,25 +141,25 @@ To see all the configuration settings, choose the **Detector configuration** tab
 
 Analyzing historical data helps you get familiar with the anomaly detection plugin. You can also evaluate the performance of a detector with historical data to further fine-tune it.
 
-To use a historical detector, the date range that you specify must have data present in at least 1,000 detection intervals.
+To use a historical detector, you need to specify a date range that has data present in at least 1,000 detection intervals.
 {: .note }
 
 1. Choose **Historical detectors** and **Create historical detector**.
 1. Enter the **Name** of the detector and a brief **Description**.
-1. For **Data source**, choose the index that you want to use as the data source. You can optionally use index patterns to choose multiple indices.
+1. For **Data source**, choose the index to use as the data source. You can optionally use index patterns to choose multiple indices.
 1. For **Time range**, select a time range for historical analysis.
-1. For **Detector settings**, choose to use settings of an existing detector. Or choose the **Timestamp field** in your index, add individual features to the detector, and set the detector interval.
+1. For **Detector settings**, choose to use the settings of an existing detector. Or choose the **Timestamp field** in your index, add individual features to the detector, and set the detector interval.
-1. You can choose to run the historical detector automatically after creating.
+1. (Optional) Choose to run the historical detector automatically after creating it.
 1. Choose **Create**.
    - You can stop the historical detector even before it completes.
 
 ### Step 7: Manage your detectors
 
-Go to the **Detector details** page to change or delete your detectors.
+To change or delete a detector, go to the **Detector details** page.
 
-1. To make changes to your detector, choose the detector name to open the detector details page.
+1. To make changes to your detector, choose the detector name.
-1. Choose **Actions**, and then choose **Edit detector**.
+1. Choose **Actions** and **Edit detector**.
-   - You need to stop the detector to change the detector configuration. In the pop-up box, confirm that you want to stop the detector and proceed.
+   - You need to stop the detector to change its configuration. Confirm that you want to stop the detector and proceed.
-1. After making your changes, choose **Save changes**.
+1. Make your changes and choose **Save changes**.
-1. To delete your detector, choose **Actions**, and then choose **Delete detector**.
+
-   - In the pop-up box, type `delete` to confirm and choose **Delete**.
+To delete your detector, choose **Actions** and **Delete detector**. In the pop-up box, type `delete` to confirm and choose **Delete**.

docs/ad/security.md

@@ -8,7 +8,7 @@ has_children: false
 
 # Anomaly detection security
 
-You can use the security plugin with anomaly detection to limit non-admin users to specific actions. For example, you might want some users to only be able to create, update, or delete detectors, while others to only view detectors.
+You can use the security plugin with anomaly detection in OpenSearch to limit non-admin users to specific actions. For example, you might want some users to only be able to create, update, or delete detectors, while others to only view detectors.
 
 All anomaly detection indices are protected as system indices. Only a super admin user or an admin user with a TLS certificate can access system indices. For more information, see [System indices](../../security/configuration/system-indices/).
 
@@ -17,7 +17,7 @@ Security for anomaly detection works the same as [security for alerting](../../a
 
 ## Basic permissions
 
-As an admin user, you can use the security plugin to assign specific permissions to users based on which APIs they need access to. For a list of supported APIs, see [Anomaly Detection API](../api/).
+As an admin user, you can use the security plugin to assign specific permissions to users based on which APIs they need access to. For a list of supported APIs, see [Anomaly detection API](../api/).
 
 The security plugin has two built-in roles that cover most anomaly detection use cases: `anomaly_full_access` and `anomaly_read_access`. For descriptions of each, see [Predefined roles](../../security/access-control/users-roles/#predefined-roles).
 
@@ -27,7 +27,7 @@ If these roles don't meet your needs, mix and match individual anomaly detection
 
 Use backend roles to configure fine-grained access to individual detectors based on roles. For example, users of different departments in an organization can view detectors owned by their own department.
 
-First, make sure that your users have the appropriate [backend roles](../../security/access-control/). Backend roles usually come from an [LDAP server](../../security/configuration/ldap/) or [SAML provider](../../security/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually](../../security/access-control/api/#create-user).
+First, make sure your users have the appropriate [backend roles](../../security/access-control/). Backend roles usually come from an [LDAP server](../../security/configuration/ldap/) or [SAML provider](../../security/configuration/saml/), but if you use the internal user database, you can use the REST API to [add them manually](../../security/access-control/api/#create-user).
 
 Next, enable the following setting:
 
@@ -83,4 +83,4 @@ PUT _opensearch/_security/api/rolesmapping/anomaly_full_access
 }
 ```
 
-Because they have different backend roles, `alice` and `bob` cannot view each other's detectors and its results.
+Because they have different backend roles, `alice` and `bob` cannot view each other's detectors or their results.

docs/ad/settings.md

@@ -8,8 +8,8 @@ nav_order: 4
 # Settings
 
 The anomaly detection plugin adds several settings to the standard OpenSearch cluster settings.
-They are dynamic, so you can change the default behavior of the plugin without restarting your cluster.
+The settings are dynamic, so you can change the default behavior of the plugin without restarting your cluster.
-You can mark them `persistent` or `transient`.
+You can mark settings as `persistent` or `transient`.
 
 For example, to update the retention period of the result index:
 
@@ -30,13 +30,13 @@ Setting | Default | Description
 `opensearch.anomaly_detection.max_anomaly_features` | 5 | The maximum number of features for a detector.
 `opensearch.anomaly_detection.ad_result_history_rollover_period` | 12h | How often the rollover condition is checked. If `true`, the plugin rolls over the result index to a new index.
 `opensearch.anomaly_detection.ad_result_history_max_docs` | 250000000 | The maximum number of documents in one result index. The plugin only counts refreshed documents in the primary shards.
-`opensearch.anomaly_detection.ad_result_history_retention_period` | 30d | The maximum age of the result index.  If its age exceeds the threshold, the plugin deletes the rolled over result index. If the cluster has only one result index, the plugin keeps it even if it's older than its configured retention period.
+`opensearch.anomaly_detection.ad_result_history_retention_period` | 30d | The maximum age of the result index.  If its age exceeds the threshold, the plugin deletes the rolled over result index. If the cluster has only one result index, the plugin keeps the index even if it's older than its configured retention period.
 `opensearch.anomaly_detection.max_entities_per_query` | 1,000 | The maximum unique values per detection interval for high cardinality detectors. By default, if the category field has more than 1,000 unique values in a detector interval, the plugin selects the top 1,000 values and orders them by `doc_count`.
 `opensearch.anomaly_detection.max_entities_for_preview` | 30 | The maximum unique category field values displayed with the preview operation for high cardinality detectors. If the category field has more than 30 unique values, the plugin selects the top 30 values and orders them by `doc_count`.
 `opensearch.anomaly_detection.max_primary_shards` | 10 | The maximum number of primary shards an anomaly detection index can have.
 `opensearch.anomaly_detection.filter_by_backend_roles` | False | When you enable the security plugin and set this to `true`, the plugin filters results based on the user's backend role(s).
 `opensearch.anomaly_detection.max_cache_miss_handling_per_second` | 100 | High cardinality detectors use a cache to store active models. In the event of a cache miss, the cache gets the models from the model checkpoint index. Use this setting to limit the rate of fetching models. Because the thread pool for a GET operation has a queue of 1,000, we recommend setting this value below 1,000.
-`opensearch.anomaly_detection.max_batch_task_per_node` | 2 | Starting a historical detector triggers a batch task. This setting is the number of batch tasks that you can run per data node. You can tune this setting from 1 to 1000. If the data nodes can't support all batch tasks and if you're not sure if the data nodes are capable of running more historical detectors, add more data nodes instead of changing this setting to a higher value.
+`opensearch.anomaly_detection.max_batch_task_per_node` | 2 | Starting a historical detector triggers a batch task. This setting is the number of batch tasks that you can run per data node. You can tune this setting from 1 to 1000. If the data nodes can't support all batch tasks and you're not sure if the data nodes are capable of running more historical detectors, add more data nodes instead of changing this setting to a higher value.
 `opensearch.anomaly_detection.max_old_ad_task_docs_per_detector` | 10 | You can run the same historical detector many times. For each run, the anomaly detection plugin creates a new task. This setting is the number of previous tasks the plugin keeps. Set this value to at least 1 to track its last run. You can keep a maximum of 1,000 old tasks to avoid overwhelming the cluster.
 `opensearch.anomaly_detection.batch_task_piece_size` | 1000 | The date range for a historical task is split into smaller pieces and the anomaly detection plugin runs the task piece by piece. Each piece contains 1,000 detection intervals by default. For example, if detector interval is 1 minute and one piece is 1000 minutes, the feature data is queried every 1,000 minutes. You can change this setting from 1 to 10,000.
 `opensearch.anomaly_detection.batch_task_piece_interval_seconds` | 5 | Add a time interval between historical detector tasks. This interval prevents the task from consuming too much of the available resources and starving other operations like search and bulk index. You can change this setting from 1 to 600 seconds.