IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Machine Learning in the Elastic Stack [7.8] ›Anomaly detection ›Supplied anomaly detection configurations
« Apache anomaly detection configurations Auditbeat anomaly detection configurations »

APM anomaly detection configurationsedit

These anomaly detection job wizards appear in Kibana if you have data from APM Agents or an APM Server stored in Elasticsearch. For more details, see the datafeed and job definitions in the apm_* folders in GitHub.

abnormal_span_durations_jsbase
abnormal_span_durations_nodejs
  • For data from Elastic APM RUM JavaScript agents or Elastic APM Node.js agents (where agent.name is js-base or nodejs).
  • Models the duration of spans (partition_field_name is span.type).
  • Detects for spans that are taking longer than usual to process (using the high_mean function).
abnormal_trace_durations_nodejs
  • For data from Elastic APM Node.js agents (where agent.name is nodejs).
  • Models the duration of trace transactions.
  • Detects trace transactions that are processing slower than usual (using the high_mean function).
anomalous_error_rate_for_user_agents_jsbase
  • For data from Elastic APM RUM JavaScript agents (where agent.name is js-base).
  • Models the error rate of user agents (partition_field_name is user_agent.name).
  • Detects user agents that are encountering errors at an above normal rate (using the high_non_zero_count function).

This job can help detect browser compatibility issues.

decreased_throughput_jsbase
decreased_throughput_nodejs
  • For data from Elastic APM RUM JavaScript agents or Elastic APM Node.js agents (where agent.name is js-base or nodejs).
  • Models the transaction rate of the application.
  • Detects periods during which the application is processing fewer requests than normal (using the low_count function).
high_count_by_user_agent_jsbase
  • For data from Elastic APM RUM JavaScript agents (where agent.name is js-base).
  • Models the request rate of user agents (partition_field_name is user_agent.name).
  • Detects user agents that are making requests at a suspiciously high rate (using the high_non_zero_count function).

This job is useful in identifying bots.

high_mean_response_time
  • For transaction data where processor.event is transaction and transaction.type is request.
  • Models response time duration of transactions.
  • Detects anomalies in high mean of transaction duration (using the high_mean function).
« Apache anomaly detection configurations Auditbeat anomaly detection configurations »