1818 (object) You can specify both `includes` and/or `excludes` patterns. If
1919 `analyzed_fields` is not set, only the relevant fields will be included. For
2020 example all the numeric fields for {oldetection}.
21+
22+ [source,js]
23+ --------------------------------------------------
24+ PUT _ml/data_frame/analytics/loganalytics
25+ {
26+ "source": {
27+ "index": "logdata"
28+ },
29+ "dest": {
30+ "index": "logdata_out"
31+ },
32+ "analysis": {
33+ "outlier_detection": {
34+ }
35+ },
36+ "analyzed_fields": {
37+ "includes": [ "request.bytes", "response.counts.error" ],
38+ "excludes": [ "source.geo" ]
39+ }
40+ }
41+ --------------------------------------------------
42+ // CONSOLE
43+ // TEST[setup:setup_logdata]
2144
2245`dest`::
23- (object) The destination configuration of the analysis. For more information,
24- see <<dfanalytics-dest-resources>>.
46+ (object) The destination configuration of the analysis. The `index` property
47+ (string) is the name of the index in which to store the results of the
48+ {dfanalytics-job}. The `results_field` (string) property defines the name of
49+ the field in which to store the results of the analysis. The default value is
50+ `ml`.
2551
2652`id`::
2753 (string) The unique identifier for the {dfanalytics-job}. This identifier can
3864 that setting. For more information, see <<ml-settings>>.
3965
4066`source`::
41- (object) The source configuration, consisting of `index` and optionally a
42- `query`. For more information, see <<dfanalytics-source-resources>>.
67+ (object) The source configuration, consisting of `index` (array) which is an
68+ array of index names on which to perform the analysis. It can be a single
69+ index or index pattern as well as an array of indices or patterns. Optionally,
70+ `source` can have a `query` (object) property. The {es} query domain-specific
71+ language (DSL). This value corresponds to the query object in an {es} search
72+ POST body. All the options that are supported by {es} can be used, as this
73+ object is passed verbatim to {es}. By default, this property has the following
74+ value: `{"match_all": {}}`.
4375
4476[[dfanalytics-types]]
4577==== Analysis objects
4678
4779{dfanalytics-cap} resources contain `analysis` objects. For example, when you
48- create a {dfanalytics-job}, you must define the type of analysis it performs.
80+ create a {dfanalytics-job}, you must define the type of analysis it performs.
81+ Currently, `outlier_detection` is the only available type of analysis, however,
82+ other types will be added, for example `regression`.
4983
5084[discrete]
5185[[oldetection-resources]]
52- ===== {oldetection-cap} configuration objects
86+ ==== {oldetection-cap} configuration objects
5387
5488An {oldetection} configuration object has the following properties:
5589
56- [discrete]
57- [[oldetection-properties]]
58- ==== {api-definitions-title}
59-
6090`n_neighbors`::
6191 (integer) Defines the value for how many nearest neighbors each method of
6292 {oldetection} will use to calculate its {olscore}. When the value is
@@ -65,44 +95,11 @@ An {oldetection} configuration object has the following properties:
6595`method`::
6696 (string) Sets the method that {oldetection} uses. If the method is not set
6797 {oldetection} uses an ensemble of different methods and normalises and
68- combines their individual {olscores} to obtain the overall {olscore}.
69- Available methods are `lof`, `ldof`, `distance_kth_nn`, `distance_knn`.
98+ combines their individual {olscores} to obtain the overall {olscore}. We
99+ recommend to use the ensemble method. Available methods are `lof`, `ldof`,
100+ `distance_kth_nn`, `distance_knn`.
70101
71102`feature_influence_threshold`::
72103 (double) The minimum {olscore} that a document needs to have in order to
73104 calculate its {fiscore}.
74- Value range: 0-1 (`0.1` by default).
75-
76- [[dfanalytics-dest-resources]]
77- ==== Dest configuration objects
78-
79- {dfanalytics-cap} resources contain `dest` objects. For example, when you
80- create a {dfanalytics-job}, you must define its destination.
81-
82- [discrete]
83- [[dfanalytics-dest-properties]]
84- ==== {api-definitions-title}
85-
86- `index`::
87- (string) The name of the index in which to store the results of the
88- {dfanalytics-job}.
89-
90- `results_field`::
91- (string) The name of the field in which to store the results of the analysis.
92- The default value is `ml`.
93-
94- [[dfanalytics-source-resources]]
95- ==== Source configuration objects
96-
97- The `source` configuration object has the following properties:
98-
99- `index`::
100- (array) An array of index names on which to perform the analysis. It can be a
101- single index or index pattern as well as an array of indices or patterns.
102-
103- `query`::
104- (object) The {es} query domain-specific language (DSL). This value
105- corresponds to the query object in an {es} search POST body. All the
106- options that are supported by {es} can be used, as this object is
107- passed verbatim to {es}. By default, this property has the following
108- value: `{"match_all": {}}`.
105+ Value range: 0-1 (`0.1` by default).
0 commit comments