What does "Feature output" mean in Anomaly Detection?

OpenSearch
1

Hi all. I’m trying to set up simple Anomaly Detection jobs, and not understanding the results. I created a feature to count the number of entries containing a particular alpha value, per hour. I expected the “Feature output” value to match the number of such values for that hour. It’s reporting a value of 83. But I have a dashboard tracking the same value, and I can see there were about 800 such values for that hour.

Can anyone explain the discrepancy? Does “count()” mean a simple count, or something else?

Thanks! :slight_smile:

image
image1886×837 85.2 KB

2

It is a simple count. Do you use the same source index and filter in Dashboard?

3

Yes. Same source index and filter.

I have other similar tests, where the “feature output” DOES match what’s in Dashboard. Still confused why this one doesn’t.

Thank you for responding!

:slight_smile:

4

I am wondering whether the hourly data starts and ends at the same time on dashboard and AD results.

In the result index, can you search and post result for the feature 83 here? The mapping of result index is here: Anomaly result mapping - OpenSearch documentation

Also, can you post the start and end time of the corresponding record on dashboard?