Anomaly detector

[ruria]

Sometimes you don´t know what to check! If one user is infected, number of emails sent goes craizy, or if an error not seen before, your server log may write a bunch of lines, much more than usual... This method can help detecting statistically outliers.

You can use it in the same way to check time series, if your free space change suddenly, why wait to 80% of your disk is full?

[id3a]

This is great, Is it possible to filter ?
Taking your example, if your monitored the free space in disk for 2 diferent disks, is it possible to make a rule only for one of them?

[ruria]

You can use "filter:" in the normal way to redefine your query. Even you can use "query_key" to check each one in isolation.

[id3a]

I'm trying to use this on cpu percentage. Here are the events

However I don't have any match with this settings

index: metricbeat-*
name: Example anomaly rule
type: anomaly
anomaly_type: up
value_field: system.cpu.user.pct
alert_on_new_data: false
K: 2
number_windows: 10
ignore_empty_window: true
timeframe:
  minutes: 10
alert:
- "debug"

[ruria]

I think you can improve performance with a filter, something like:

 filter:
 - term:
     metricset.name: "cpu"

Anyway, there was not support for dots in fields names, try a git pull now, and give it a shot.

thanks for testing!

[Dmitry1987]

This PR looks very interesting! Gotta try.

[jakes44]

Yeah, anybody had success with this? Would definitely want to get this merged if possible... Exactly what I need for use cases at work. Collecting metrics with metricbeat, and this is a great way to trigger alerts based on existing data.

[Dmitry1987]

@Qmando , what do you think about this PR, do you plan to merge it in one of future versions?

[ruria]

There are some bugs we're working on right now. I'll push the patch no later the end of the week.

[ruria]

Sorry for the delay!

[Dmitry1987]

Wow that's a massive update, awesome job @ruria ! Thank you!

[Paraomao]

Good!

[vsabelli]

Hello everybody,

do you have any news about this PR? @ruria @Qmando

[ruria]

Can I help @Qmando ?

[nsano-rururu]

@ruria
Are you planning to make a pull request to elastalert2?
https://github.com/jertel/elastalert2