Bad anomaly detection dynamic threshold

Plugins Observability
1

Hello, v2.17 here, with a few anomaly detectors in place. It sometimes happens that an well detected anomaly (as seen in the dashboard) doesn’t show up in the custom result index. This is due to the dynamic threshold field that makes the engine decide by itself whether an anomaly grade is worth something or not.

Is there a way to tune or disable that threshold ? I would be happy with all the anomalies ending up in the custom result index anyhow.

I quote Anomaly result mapping - OpenSearch Documentation

One of the criteria for a detector to classify a data point as an anomaly is that its anomaly_score must surpass a dynamic threshold. This field records the current threshold.

2

@elge I do not believe there is any configuration option available to change this. You can have a look at the hardcoded values in HybridThresholdingModel.java

It would be useful to configure this using opensearch.yml configuration perhaps, therefore I’d recommend to add this as feature request in github project.