Does Anomaly detection support multi-bucket anomalies similar to
multi-bucket anomaly
Multi bucket anomaly detection helps detect slow bleeding anomalies that occur over multiple sequential windows. If it is not currently supported, are there alternatives such as running anomaly detection on index roll ups to get similar behavior?
You can configure multiple features in a anomaly detector, that can detect anomalies across multiple buckets, take a look at the documentation for more details: https://opensearch.org/docs/latest/observing-your-data/ad/index/.
Understand that we can configure multiple features per detector but we are looking for an ability where the detector would be able to detect anomalies occurring over multiple bucket intervals as outlined in the elastic blog
Our concept of shingle is similar to multi-bucket anomaly where the data in the immediate segment acts as a context for the most recent one. By default, our shingle size is 8 so we are detecting 8-bucket anomaly instead of single bucket.
Read: Anomaly detection - OpenSearch Documentation for details
