Help for creating manuel alert which anomaly can not detect

OpenSearch
1

Hi team,

I use anomaly detection and it works very good but anomaly can not detect if there is no time series data.

For example, I use 6 shingle period with 10 min. If there is no any any in this period and after get in net 8 shingle 10 min period and there are high number of value log, anomaly can not measure it correctly and can not generate alert for it. Let me share screenshot to explain ;

image
image1318×291 42.5 KB

I created anomaly for error messages types. In the screenshot, in normal period, there is no 404-url-not-found error but suddenly it goes up. Anomaly can not measure it as anomaly becuase before that time ,there is no 404-url-not-found error.

How can I detect this type of peaks?

Thanks,

Emre

2

We currently don’t support this scenario, as models require historical data to learn effectively. When a new error type first appears, we haven’t yet trained a dedicated model for it. In such cases, we should rely on population analysis (not yet implemented in OpenSearch AD) instead of comparing solely against the same error type. Specifically, we would compare against the average behavior across error types. Typically, the average error count is very low or zero, so the sudden appearance of a new error—such as a “404-url-not-found”—should be identified as an outlier.