Results from machine learning anomaly detection jobs that use geographical functions can now be viewed in Elastic Maps. The 8.1.0 release of Elastic Maps can generate a map of the anomalies by location and help you explore new trends in your data.

blog-elastic-elasticmaps-1.png

Once you’ve created the job and it has produced some results, you can navigate to Elastic Maps to view them.

blog-elastic-elasticmaps-2.png

Navigate to Elastic Maps and select Create Map, then select Add Layer. You should see the ML Anomalies layer card option which you can now select.

blog-elastic-elasticmaps-3.png

Once you have a job selected, notice - in the screenshots below - that you can choose between a few layer options: ‘Actual’, ‘Typical’, and ‘Actual to typical’.

blog-elastic-elasticmaps-4.png

As shown in the expanded legend in the above screenshot, the points are colored according to the severity level of the anomaly - this is determined by the record score of the anomaly.

blog-elastic-elasticmaps-5.png

The ‘Typical to actual’ layer connects the typical location, found by the analytical modeling, to the actual location with a line to highlight the difference between these locations.

blog-elastic-elasticmaps-6.png

It might be useful to view all three layers at once so you can view a vehicle’s actual location alongside the typical location. This might be a bit overwhelming when you’ve got a lot of data to visualize on the map.

blog-elastic-elasticmaps-7.png

Hovering over one of these points, as shown in the image below, you can see in the tooltip the vehicle id of the particular bus - in this case, it’s 4291.

blog-elastic-elasticmaps-8.png

You can narrow the results on the map even further to only view anomalies for that vehicle id.

blog-elastic-elasticmaps-9.png

In the screenshot below, the swim lane cell for vehicle id 4291 has been selected - you can now select the `Open in Maps` link above the embedded map.

blog-elastic-elasticmaps-10.png

This will take you directly into Elastic Maps with a filter already in place for that particular vehicle id.

blog-elastic-elasticmaps-11.png

blog-maps-top-10-thumbnail.png

Elastic Maps now supports the Machine Learning Anomalies Layer

Anomaly detection, one of the <a href="/what-is/elastic-stack-machine-learning">Elastic machine learning features</a>, has been a great way of signaling when there’s an issue in a dataset. Until now, there’s been no easy way to focus in on anomalies for a particular field. This is especially true when the field of interest is not one of the top N shown in the results view.
The release of Kibana 7.2 introduces a new query bar in the Machine Learning app in Kibana to make it easier for users to search the anomaly results for specific potential influencers.
<h2>Using the query bar with NGINX events</h2>The data used in the following example contains anonymized data from elastic.co web access logs processed by Filebeat’s <a href="/guide/en/beats/filebeat/7.2/filebeat-module-nginx.html">NGINX</a> module configuration (14,479,391 events collected over 38 days).
In this example, we’ve created a job to detect unusual activity in the number of incoming requests — something that could be indicative of an attack.
A normal user is limited by how quickly they can manually navigate to website pages, whereas an attacker or bot may be able to flood a website with requests. Assuming the majority of clients are normal users, we can detect atypical behavior by looking at unusually high event rate for a client:
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt4ceb11958b75308f/5d37569c5cb66453b1279a50/ml-anomaly-explorer-high-event-rate-blog.jpg" data-sys-asset-uid="blt4ceb11958b75308f" alt="Display of IP addresses with high event rates" style="display: block; margin: auto;">
The results show several anomalous clients; 185.78.31.85 especially seems to show anomalous activity over a longer period of time.
In this case, we are interested in only viewing results for that specific IP. Using the query bar, we can narrow the results for 185.78.31.85.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt2cedaad33047c466/5d3757711f2f0457e07e2b43/ml-anomaly-explorer-ip-search-blog.gif" data-sys-asset-uid="blt2cedaad33047c466" alt="Display narrowing results to specific IP address" style="display: block; margin: auto;">
With the query bar, we now have the ability to search through anomaly results to focus in on one or more selected <a href="/guide/en/kibana/7.2/job-tips.html#influencers">influencers</a>. The query bar suggests influencer field names and values for selected jobs as it receives input. Auto-suggest makes it easy to view possible fields and values we can search by; we’re no longer limited to seeing only the top ten shown in the results view.
The query bar accepts input in <a href="/guide/en/kibana/7.2/kuery-query.html">KQL syntax</a>. Users can combine queries using AND or OR keywords and can filter by field value only.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt256ed8acee0a410b/5d3757ad1f2f0457e07e2b49/ml-anomaly-explorer-combine-queries-blog.png" data-sys-asset-uid="blt256ed8acee0a410b" alt="Combining queries to show two different IP addresses" style="display: block; margin: auto;">
Wildcard queries are supported. Searching for <code>source.address: 185*</code>, for example, narrows the displayed results to all IP values beginning with <code>185</code>.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltca1e436f81fccf3f/5d375899e2285157535437e7/ml-anomaly-explorer-wildcard-query-blog.png" data-sys-asset-uid="bltca1e436f81fccf3f" alt="Query including a wildcard" style="display: block; margin: auto;">
If the influencer of interest is listed in Top Influencers, clicking the plus icon next to it will add that field/value combination to the query bar and apply the search. Removing the search can be accomplished by clicking the minus icon. This can also be done from the results table.
<img src="https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/bltc36e08b0df9ee8cf/5d3758d32a506857d64efc9a/ml-anomaly-explorer-influencers-blog.gif" data-sys-asset-uid="bltc36e08b0df9ee8cf" alt="Using Top Influencers to alter query" style="display: block; margin: auto;">
At Elastic, we like to build search into everything we do. The query bar provides an easy way to search through anomalies for one or more particular influencers, allowing for easier result navigation. This is especially useful when a field is not one of the top N shown in the results view.
Interested in trying it out? Nab a <a href="/elasticsearch/service">free 14-day trial of the Elasticsearch Service</a>. If you have feedback or questions we invite you to join the conversation in the machine learning <a href="https://discuss.elastic.co/">Discuss forum</a>.
.

kibana-improved-querying.jpg

kibana-query-cowboy.jpg

Find influencers faster with the machine learning Anomaly Explorer query bar

Start free trial

Blog Footer CTA

Sign up for Elastic Cloud free trial

Melissa Alvarez

Надсилаючи цю форму ви погоджуєтеся з <a href="/legal/terms-of-use">Умовами надання послуг Elastic</a>. Ваші особисті дані будуть опрацьовані відповідно з <a href="/legal/privacy-statement">Положеннями про конфіденційність Elastic</a>.

Newsletter GDPR Text - Ukrainian

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_self">Terms of Service</a>, and you agree to receive the <a href="/legal/privacy-statement#how-we-use-the-information" target="_self">selected communications</a> at the contact details you provided above. See <a href="/legal/privacy-statement/" target="_self">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Communication Preferences - ONLY for /communication-preferences

By submitting you agree to <a href="/agreements/global/cloud-services-monthly" rel="nofollow">Elastic Cloud Terms of Service</a>. Your personal data will be processed in accordance with <a href="/legal/privacy-statement">Elastic's Privacy Statement</a>.

Cloud Trial GDPR Text

Intentionally Blank

By submitting you acknowledge that you've read and agree to our <a href="/legal/serverless-preview-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Serverless GDPR Text

提交即表示您確認已詳閱並同意我們的<a href="/legal/elastic-cloud-account-terms" target="_blank">服務條款</a>，且同意 Elastic 使用您在上方提供的個人資料<a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">與您聯絡</a>，為您提供相關產品和服務的資訊。如需詳細說明或隨時想停止收到產品和服務資訊，請參閱 <a href="/legal/privacy-statement/" target="_blank">Elastic 的隱私聲明</a>。

Newsletter GDPR Text - TW

By submitting you acknowledge that you've read and agree to our <a href="/legal/elastic-cloud-account-terms" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.By submitting this form, I agree to Elastic sharing my contact information with Google Cloud. I also agree to Elastic giving my information to the vendor for the purpose of shipping my food package.

GDPR Text + Google Cloud

Inviando la registrazione (1) esprimi il consenso ai <a href="/legal/terms-of-use">termini e condizioni di Elastic</a> e <a href="/legal/privacy-statement">all’informativa sulla privacy</a>, nonché (2) a ricevere saltuarie e-mail.

Newsletter GDPR Text - Italian

By submitting you acknowledge that you've read and agree to our <a href="/legal/terms-of-use" target="_blank">Terms of Service</a>, and that Elastic may <a href="/legal/privacy-statement#how-we-use-the-information" target="_blank">contact you</a> about our related products and services, using the details you provide above. See <a href="/legal/privacy-statement/" target="_blank">Elastic’s Privacy Statement</a> for more details or to opt-out at any time.

Newsletter GDPR Text

Load more

Overview

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content

Can't make it? Register and we'll send you the recording. You'll also receive an email with related content.

You'll also receive an email with related content.

You'll also receive an email with related content

Speakers

Close

See more insights

The content on this page is not available in the selected language. As Elastic grows globally, we continue to support content in multiple languages.

Author

Articles by Melissa Alvarez

Elastic Maps now supports the Machine Learning Anomalies Layer

Find influencers faster with the machine learning Anomaly Explorer query bar