Skip to content

Commit e72d950

Browse files
[8.16] Updates phrasing when referring to pages (backport #2864) (#2867)
* Updates phrasing when referring to pages (#2864) * Updates phrasing when referring to pages * Fixes typos * Replaces 'global search bar' with 'global search field' (cherry picked from commit d015f34) # Conflicts: # docs/en/stack/ml/anomaly-detection/ml-detect-categories.asciidoc # docs/en/stack/ml/anomaly-detection/ml-population-analysis.asciidoc * Resolves merge conflict --------- Co-authored-by: kosabogi <[email protected]>
1 parent 6366d8e commit e72d950

13 files changed

+152
-57
lines changed

docs/en/stack/ml/anomaly-detection/ml-ad-run-jobs.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ a {dfeed} will be required.
3333
You can create {anomaly-jobs} by using the
3434
{ref}/ml-put-job.html[create {anomaly-jobs} API]. {kib} also provides
3535
wizards to simplify the process, which vary depending on whether you are using
36-
the {ml-app} app, {security-app} or {observability} apps. In *{ml-app}* >
37-
*Anomaly Detection*:
36+
the {ml-app} app, {security-app} or {observability} apps. To open *Anomaly Detection*,
37+
find *{ml-app}* in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
3838

3939
[role="screenshot"]
4040
image::images/ml-create-job.png[Create New Job]

docs/en/stack/ml/anomaly-detection/ml-detect-categories.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ Avoid using human-generated data for categorization analysis.
3333
[[creating-categorization-jobs]]
3434
== Creating categorization jobs
3535

36-
. In {kib}, navigate to **{ml-app} > Anomaly Detection > Jobs**.
37-
. Click **Create {anomaly-jobs}**, select the {data-view} you want to analyze.
36+
. In {kib}, navigate to *Jobs*. To open *Jobs*, find **{ml-app} > Anomaly Detection** in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
37+
. Click **Create job**, select the {data-view} you want to analyze.
3838
. Select the **Categorization** wizard from the list.
3939
. Choose a categorization detector - it's the `count` function in this example - and the field you want to categorize - the `message` field in this example.
4040
+

docs/en/stack/ml/anomaly-detection/ml-jobs-from-visuals.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ NOTE: You need to have a compatible visualization on **Dashboard** to create an
4040
which is based on the {kib} sample flight data set. Select the `Flight count`
4141
visualization from the dashboard.
4242

43-
. Go to **Analytics > Dashboard** and select a dashboard with a compatible
43+
. Go to **Analytics > Dashboard** from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field]. Select a dashboard with a compatible
4444
visualization.
4545
. Open the **Options (...) menu** for the panel, then select **More**.
4646
. Select **Create {anomaly-job}**. The option is only displayed if the
Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
[[ml-configuring-populations]]
2+
= Performing population analysis
3+
4+
Population analysis is a method of detecting anomalies by comparing the behavior of entities or events within a specified population.
5+
In this approach, {ml} analytics create a profile of what is considered "typical" behavior for users, machines, or other entities over a specified time period.
6+
An entity is considered as anomalous when its behavior deviates from that of the population, indicating abnormal activity compared to the rest of the population.
7+
8+
This type of analysis is most effective when the behavior within a group is generally homogeneous, allowing for the identification of unusual patterns.
9+
However, it is less useful when members of the population show vastly different behaviors.
10+
In such cases, you can segment your data into groups with similar behaviors and run separate jobs for each.
11+
This can be done by using a query filter in the datafeed or by applying the `partition_field_name` to split the analysis across different groups.
12+
13+
Population analysis is resource-efficient and scales well, enabling the analysis of populations consisting of hundreds of thousands or even millions of entities with a lower resource footprint than analyzing each series individually.
14+
15+
16+
17+
[discrete]
18+
[[population-recommendations]]
19+
== Recommendations
20+
21+
* Use population analysis when the behavior within a group is mostly homogeneous, as it helps identify anomalous patterns effectively.
22+
* Leverage population analysis when dealing with large-scale datasets.
23+
* Avoid using population analysis when members of the population exhibit vastly different behaviors, as it may not be effective.
24+
25+
26+
[discrete]
27+
[[creating-population-jobs]]
28+
== Creating population jobs
29+
30+
. In {kib}, navigate to *Jobs*. To open *Jobs*, find **{ml-app} > Anomaly Detection** in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
31+
. Click **Create job**, select the {data-source} you want to analyze.
32+
. Select the **Population** wizard from the list.
33+
. Choose a population field - it's the `clientip` field in this example - and the metric you want to use for the analysis - `Mean(bytes)` in this example.
34+
+
35+
--
36+
[role="screenshot"]
37+
image::images/ml-population-wizard.png[Creating a population job in Kibana]
38+
--
39+
. Click **Next**.
40+
. Provide a job ID and click **Next**.
41+
. If the validation is successful, click **Next** to review the summary of the job creation.
42+
. Click **Create job**.
43+
44+
[%collapsible]
45+
.API example
46+
====
47+
To specify the population, use the `over_field_name` property. For example:
48+
49+
[source,console]
50+
----------------------------------
51+
PUT _ml/anomaly_detectors/population
52+
{
53+
"description" : "Population analysis",
54+
"analysis_config" : {
55+
"bucket_span":"15m",
56+
"influencers": [
57+
"clientip"
58+
],
59+
"detectors": [
60+
{
61+
"function": "mean",
62+
"field_name": "bytes",
63+
"over_field_name": "clientip" <1>
64+
}
65+
]
66+
},
67+
"data_description" : {
68+
"time_field":"timestamp",
69+
"time_format": "epoch_ms"
70+
}
71+
}
72+
----------------------------------
73+
// TEST[skip:needs-licence]
74+
75+
<1> This `over_field_name` property indicates that the metrics for each client (as identified by their IP address) are analyzed relative to other clients in each bucket.
76+
====
77+
78+
[discrete]
79+
[[population-job-results]]
80+
=== Viewing the job results
81+
82+
Use the **Anomaly Explorer** in {kib} to view the analysis results:
83+
84+
[role="screenshot"]
85+
image::images/ml-population-anomalies.png["Population results in the Anomaly Explorer"]
86+
87+
The results are often quite sparse.
88+
There might be just a few data points for the selected time period.
89+
Population analysis is particularly useful when you have many entities and the data for specific entitles is sporadic or sparse.
90+
If you click on a section in the timeline or swim lanes, you can see more details about the anomalies:
91+
92+
[role="screenshot"]
93+
image::images/ml-population-anomaly.png["Anomaly details for a specific user"]
94+
95+
In this example, the client IP address `167.145.234.154` received a high volume of bytes on the date and time shown.
96+
This event is anomalous because the mean is four times higher than the expected behavior of the population.

docs/en/stack/ml/anomaly-detection/ml-revert-model-snapshot.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ resilience. It makes it possible to reset the model to a previous state in case
77
of a system failure or if the model changed significantly due to a one-off
88
event.
99

10-
. In {kib}, navigate to **{ml-app} > Anomaly Detection > Jobs**.
10+
. In {kib}, navigate to *Jobs*. To open *Jobs*, find **{ml-app} > Anomaly Detection** in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
1111
. Locate the {anomaly-job} whose model you want to revert in the job table.
1212
. Open the job details and navigate to the **Model Snapshots** tab.
1313
+

docs/en/stack/ml/df-analytics/ml-dfa-shared.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
tag::dfa-deploy-model[]
22
. To deploy {dfanalytics} model in a pipeline, navigate to **Machine Learning** >
3-
**Model Management** > **Trained models** in {kib}.
3+
**Model Management** > **Trained models** in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field] in {kib}.
44
55
. Find the model you want to deploy in the list and click **Deploy model** in
66
the **Actions** menu.

docs/en/stack/ml/get-started/ml-gs-results.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ request rate on your web site drops significantly.
3434

3535
Let's start by looking at this simple job in the **Single Metric Viewer**:
3636

37-
. Select the *Anomaly Detection* tab in *{ml-app}* to see the list of your
37+
. Select the *Jobs* tab in *{ml-app}* to see the list of your
3838
{anomaly-jobs}.
3939

4040
. Click the chart icon in the *Actions* column for your `low_request_rate` job
@@ -151,7 +151,7 @@ look at both high and low request rates partitioned by response code.
151151
Let's start by looking at the `response_code_rates` job in the
152152
**Anomaly Explorer**:
153153

154-
. Select the *Anomaly Detection* tab in *{ml-app}* to see the list of your
154+
. Select the *Jobs* tab in *{ml-app}* to see the list of your
155155
{anomaly-jobs}.
156156

157157
. Open the `response_code_rates` job in the Anomaly Explorer to view its results

docs/en/stack/ml/get-started/ml-gs-visualizer.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ exception for your {kib} URL.
1717

1818
--
1919

20-
. Click *Machine Learning* in the {kib} main menu.
20+
. Open *Machine Learning* from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
2121

2222
. Select the *{data-viz}* tab.
2323

docs/en/stack/ml/nlp/ml-nlp-e5.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ NOTE: For most cases, the preferred version is the **Intel and Linux optimized**
9292
[[trained-model-e5]]
9393
==== Using the Trained Models page
9494
95-
1. In {kib}, navigate to **{ml-app}** > **Trained Models**. E5 can be found in
95+
1. In {kib}, navigate to **{ml-app}** > **Trained Models** from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field]. E5 can be found in
9696
the list of trained models. There are two versions available: one portable
9797
version which runs on any hardware and one version which is optimized for Intel®
9898
silicon. You can see which model is recommended to use based on your hardware
@@ -250,7 +250,7 @@ xpack.ml.model_repository: file://${path.home}/config/models/`
250250
. Repeat step 2 and step 3 on all master-eligible nodes.
251251
. {ref}/restart-cluster.html#restart-cluster-rolling[Restart] the
252252
master-eligible nodes one by one.
253-
. Navigate to the **Trained Models** page in {kib}, E5 can be found in the
253+
. Navigate to the **Trained Models** page from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field] in {kib}. E5 can be found in the
254254
list of trained models.
255255
. Click the **Add trained model** button, select the E5 model version you
256256
downloaded in step 1 and want to deploy and click **Download**. The selected

docs/en/stack/ml/nlp/ml-nlp-elser.asciidoc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ master-eligible nodes can reach the server you specify.
351351
. Repeat step 5 on all master-eligible nodes.
352352
. {ref}/restart-cluster.html#restart-cluster-rolling[Restart] the
353353
master-eligible nodes one by one.
354-
. Navigate to the **Trained Models** page in {kib}, ELSER can be found in the
354+
. Navigate to the **Trained Models** page from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field] in {kib}. ELSER can be found in the
355355
list of trained models.
356356
. Click the **Add trained model** button, select the ELSER model version you
357357
downloaded in step 1 and want to deploy, and click **Download**. The selected
@@ -391,7 +391,7 @@ xpack.ml.model_repository: file://${path.home}/config/models/`
391391
. Repeat step 2 and step 3 on all master-eligible nodes.
392392
. {ref}/restart-cluster.html#restart-cluster-rolling[Restart] the
393393
master-eligible nodes one by one.
394-
. Navigate to the **Trained Models** page in {kib}, ELSER can be found in the
394+
. Navigate to the **Trained Models** page from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field] in {kib}. ELSER can be found in the
395395
list of trained models.
396396
. Click the **Add trained model** button, select the ELSER model version you
397397
downloaded in step 1 and want to deploy and click **Download**. The selected
@@ -407,7 +407,7 @@ allocations and threads per allocation values.
407407
== Testing ELSER
408408

409409
You can test the deployed model in {kib}. Navigate to **Model Management** >
410-
**Trained Models**, locate the deployed ELSER model in the list of trained
410+
**Trained Models** from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field] in {kib}. Locate the deployed ELSER model in the list of trained
411411
models, then select **Test model** from the Actions menu.
412412

413413
You can use data from an existing index to test the model. Select the index,

docs/en/stack/ml/nlp/ml-nlp-inference.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ can use it to perform {nlp} tasks in ingest pipelines.
1818
== Add an {infer} processor to an ingest pipeline
1919

2020
In {kib}, you can create and edit pipelines in **{stack-manage-app}** >
21-
**Ingest Pipelines**.
21+
**Ingest Pipelines**. To open **Ingest Pipelines**, find **{stack-manage-app}** in the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field].
2222

2323
[role="screenshot"]
2424
image::images/ml-nlp-pipeline-lang.png[Creating a pipeline in the Stack Management app,align="center"]

docs/en/stack/ml/nlp/ml-nlp-ner-example.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ You can create a tag cloud to visualize your data processed by the {infer}
294294
pipeline. A tag cloud is a visualization that scales words by the frequency at
295295
which they occur. It is a handy tool for viewing the entities found in the data.
296296

297-
In {kib}, open **Stack management** > **{data-sources-cap}**, and create a new
297+
In {kib}, open **Stack management** > **{data-sources-cap}** from the main menu, or use the {kibana-ref}/kibana-concepts-analysts.html#_finding_your_apps_and_objects[global search field], and create a new
298298
{data-source} from the `les-miserables-infer` index pattern.
299299

300300
Open **Dashboard** and create a new dashboard. Select the

0 commit comments

Comments
 (0)