Dissecting the detector
At the heart of the anomaly detection job are the analysis configuration and the detector. The detector has several key components to it:
- The function
- The field
- The partition field
- The by field
- The over field
We will go through each in turn to fully understand them all. Note that in the next few sections, however, we will often refer to the actual names of settings within the job configuration as if we were using the advanced job editor or the API. Although it is good to fully understand the nomenclature, as you progress through this chapter you will also notice that many of the details of the job configuration are abstracted away from the user or are given more "UI-friendly" labels than the real setting names.
The function
The detector function describes how the data will be aggregated or measured within the analysis interval (bucket span). There are many functions, but they can be classified into the following...
