Detect Anomalies on aggregation feature X based on aggregation feature Y

Plugins Machine Learning
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch 3.0.0

Describe the issue:
Context:
Suppose that I have documents with a certain field called ‘category’. This field can take on values ‘a’, ‘b’ and ‘c’ (each document can only take on one of these values).

Question:
Is there a way that I can get the document value_count where ‘category’ has value ‘a’, get a separate value_count where ‘category’ has value ‘b’, and then detect anomalies based on both the value_counts?

Example:
In one interval, when there are 100 documents with ‘category’ value of ‘a’, there are usually 80 documents with ‘category’ value of ‘b’. Can I detect anomalies if instead of 80 documents, there are only 20 documents with ‘category’ value of ‘b’? (assuming that there are still 100 documents with ‘category’ value of ‘b’)

2

@zvirani, I think you’re looking for a correlation function in Anomaly detection. According to the documentation, there is no such function available.

1 Like