Skip to content
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/en/stack/ml/anomaly-detection/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,8 @@ include::ootb-ml-jobs-logs-ui.asciidoc[leveloffset=+2]

include::ootb-ml-jobs-metricbeat.asciidoc[leveloffset=+2]

include::ootb-ml-jobs-metrics-ui.asciidoc[leveloffset=+2]

include::ootb-ml-jobs-nginx.asciidoc[leveloffset=+2]

include::ootb-ml-jobs-siem.asciidoc[leveloffset=+2]
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
[role="xpack"]
[[ootb-ml-jobs-metrics-ui]]
= Metrics {anomaly-detect} configurations
++++
<titleabbrev>Metrics</titleabbrev>
++++

// tag::metrics-jobs[]
These {anomaly-jobs} can be created in the
{kibana-ref}/xpack-infra.html[Metrics app] in {kib}. When you create one of
these jobs, you need to select a field that splits the data to establish
separate baselines for the job. This is called a partion field. Each value of
the partition field is modeled individually which enables more independent
anomaly scoring.

When you select partition field for a job, take into account field cardinality;
the number of different values that the field contains. If the partition field
has more than 1000 distinct values per job, you are advised that there might be
high memory usage.

The jobs below detect anomalous memory and network behavior on hosts and
Kubernetes pods. For more details, see the {dfeed} and job definitions in the
`metrics_ui_*` folders in https://github.com/elastic/kibana/tree/{branch}/x-pack/plugins/ml/server/models/data_recognizer/modules[GitHub].


hosts_memory_usage::

* For memory usage via the Metrics UI.
* Models system memory usage.
* Detects unusual increases in memory usage across hosts.


hosts_network_in::

* For network traffic via the Metrics UI.
* Models inbound network traffic.
* Detects unusually high inbound traffic across hosts.


hosts_network_out::

* For network traffic via the Metrics UI.
* Models outbound network traffic.
* Detects unusually high outbound traffic across hosts.


k8s_memory_usage::

* For memory usage via the Metrics UI.
* Models system memory usage.
* Detects unusual increases in memory usage across Kubernetes pods.


k8s_network_in::

* For network traffic via the Metrics UI.
* Models inbound network traffic.
* Detects unusually high inbound traffic across Kubernetes pods.


k8s_network_out::

* For network traffic via the Metrics UI.
* Models outbound network traffic.
* Detects unusually high outbound traffic across Kubernetes pods.


// end::metrics-jobs[]
1 change: 1 addition & 0 deletions docs/en/stack/ml/anomaly-detection/ootb-ml-jobs.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ the {anomaly-jobs} that are ready to use via {kib}.
* <<ootb-ml-jobs-auditbeat>>
* <<ootb-ml-jobs-logs-ui>>
* <<ootb-ml-jobs-metricbeat>>
* <<ootb-ml-jobs-metrics-ui>>
* <<ootb-ml-jobs-nginx>>
* <<ootb-ml-jobs-siem>>
* <<ootb-ml-jobs-uptime>>