APM anomaly detection configurationsedit

These anomaly detection job wizards appear in Kibana if you have data from APM Agents or an APM Server stored in Elasticsearch. For more details, see the datafeed and job definitions in the apm_* folders in GitHub.

NodeJSedit

Detect abnormal traces, anomalous spans, and identify periods of decreased throughput.

abnormal_span_durations_nodejs
  • For data from Elastic APM Node.js Agents (where agent.name is nodejs).
  • Models the duration of spans (partition_field_name is span.type).
  • Detects for spans that are taking longer than usual to process (using the high_mean function).
abnormal_trace_durations_nodejs
  • For data from Elastic APM Node.js Agents (where agent.name is nodejs).
  • Models the duration of trace transactions.
  • Detects trace transactions that are processing slower than usual (using the high_mean function).
decreased_throughput_nodejs
  • For data from Elastic APM Node.js Agents (where agent.name is nodejs).
  • Models the transaction rate of the application.
  • Detects periods during which the application is processing fewer requests than normal (using the low_count function).

RUM Javascriptedit

Detect problematic spans and identify user agents that are potentially causing issues.

abnormal_span_durations_jsbase
  • For data from Elastic APM RUM JavaScript Agents (where agent.name is js-base).
  • Models the duration of spans (partition_field_name is span.type).
  • Detects for spans that are taking longer than usual to process (using the high_mean function).
anomalous_error_rate_for_user_agents_jsbase

This job can help detect browser compatibility issues.

  • For data from Elastic APM RUM JavaScript Agents (where agent.name is js-base).
  • Models the error rate of user agents (partition_field_name is user_agent.name).
  • Detects user agents that are encountering errors at an above normal rate (using the high_non_zero_count function).
decreased_throughput_jsbase
  • For data from Elastic APM RUM JavaScript Agents or Elastic APM Node.js Agents (where agent.name is js-base).
  • Models the transaction rate of the application.
  • Detects periods during which the application is processing fewer requests than normal (using the low_count function).
high_count_by_user_agent_jsbase

This job is useful in identifying bots.

  • For data from Elastic APM RUM JavaScript Agents (where agent.name is js-base).
  • Models the request rate of user agents (partition_field_name is user_agent.name).
  • Detects user agents that are making requests at a suspiciously high rate (using the high_non_zero_count function).

Transactionsedit

Detect anomalies in transactions from your APM services.

high_mean_transaction_duration
  • For transaction data where processor.event is transaction.
  • Models duration of transactions by transaction type for APM services.
  • Detects anomalies in high mean of transaction duration (using the high_mean function).