As seen in Chapter 2, Installing the Elastic Stack with Machine Learning, Elastic ML jobs contain detectors for a combination of a function applied to some aspect of the data (for example, a field). The example jobs shown in Chapter 2, Installing the Elastic Stack with Machine Learning, have detectors using metric-based functions operating on metric-based fields (such as CPU utilization). However, the detectors we will be exploring in this chapter will be those that simply count occurrences of things over time.
The three main functions to get familiar with are as follows:
- Count: Counts the number of documents in the bucket resulting from a query of the raw data index
- High Count: The same as Count, but will only flag an anomaly if the count is higher than expected
- Low Count: The same as Count, but will only flag an anomaly if the count is lower than...
