Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Anomaly Detection with the Elastic Stack
Search
Kosho Owa
December 15, 2016
Technology
1
1.8k
Anomaly Detection with the Elastic Stack
Prelert: Elastic Stackを利用した異常検知
Elastic{ON} Tour Tokyo 2016
Kosho Owa
December 15, 2016
Tweet
Share
More Decks by Kosho Owa
See All by Kosho Owa
Introducing Machine Learning for the Elastic Stack
kosho
2
12k
Elastic Stack X-Pack 5.0 for IT Security Workshop
kosho
1
280
Elastic Stack X-Pack 5.0 for IT Ops Workshop
kosho
0
290
[Developers Summit 2017] Anomaly Detection with the Elastic Stack
kosho
1
660
Getting Started with Elastic Cloud and Beats for Log Analytics
kosho
0
81
Elastic{ON} Seminar Tokyo 2016 Product Update
kosho
0
150
Introducing Elastic Cloud
kosho
0
63
Gearing Up for Elastic Stack, X-Pack 5.0 Releases
kosho
0
130
Elastic Stack Hands-on Workshop (EN)
kosho
1
140
Other Decks in Technology
See All in Technology
Kernel MemoryでAzure OpenAI Serviceとお手軽データソース連携
mitsuzono
1
140
長期間TiDBを使ってきた話 @ 私たちはなぜNewSQLを使うのかTiDB選定5社が語る選定理由と活用LT / Experiences with TiDB Over Time
chibiegg
2
840
ここが嬉しいABAC ここが辛いよABAC #再解説+補足編
masahirokawahara
1
260
Discord とビルダー&チャットボットの使い方 / How to use Discord and Builder & Chatbots
ks91
PRO
0
160
WebアプリケーションにおけるPDOの使い方入門 / phpcon odawara 2024
meihei3
2
440
Compose Compiler Metricsを使った実践的なコードレビュー
tomorrowkey
1
210
検証を通して見えてきたTiDBの性能特性
lycorptech_jp
PRO
6
3.7k
コードを書く隙間を見つけて生きていく技術/Findy 思考の現在地
fujiwara3
27
5.7k
反実仮想機械学習とは何か
usaito
PRO
8
2.9k
少数チームで挑む: SwiftUI, TCA, KMPを用いた 新規動画配信アプリ 「ABEMA Live」の開発について
tomu28
0
600
On Your Data を超えていく!
hirotomotaguchi
2
610
Next'24 事例セッションの紹介とクラウド資格を活用したキャリア形成について語りMuscle
yasumuusan
1
410
Featured
See All Featured
The Pragmatic Product Professional
lauravandoore
24
5.8k
How to name files
jennybc
64
93k
Automating Front-end Workflow
addyosmani
1355
200k
Being A Developer After 40
akosma
56
580k
Build The Right Thing And Hit Your Dates
maggiecrowley
23
2k
VelocityConf: Rendering Performance Case Studies
addyosmani
320
23k
Put a Button on it: Removing Barriers to Going Fast.
kastner
58
3k
A better future with KSS
kneath
231
16k
Building Better People: How to give real-time feedback that sticks.
wjessup
354
18k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
220
21k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
186
16k
Rebuilding a faster, lazier Slack
samanthasiow
72
8.2k
Transcript
Prelert: Elastic StackΛར༻ͨ͠ҟৗݕ େྠ ߂ৄ | Kosho Owa Solutions Architect,
Elastic
*5ΦϖϨʔγϣϯ • ࣗͷγεςϜਖ਼ৗʹՔಇ͍ͯ͠Δ? • ͲͷΑ͏ʹᮢΛஅ͢Δ? • ͕ൃੜͨ࣌͠ʹɺͲͷΑ͏ʹݪҼΛݟ͚ͭΔ? 2
*5ηΩϡϦςΟ • ϚϧΣΞʹ৵ೖ͞Ε͍ͯΔγεςϜແ͍͔? • ϚϧΣΞ͕ͲͷΑ͏ʹײછΛ͔͛ͨ? • જࡏతʹڴҖͱͳΔ৫෦ͷϢʔβʔ୭͔? 3
ͦͷଞ • ͲͷΑ͏ʹɺଟ͘ͷछྨͷ࣌ܥྻσʔλͱ͖߹͏͔? • ਖ਼ৗʹՔಇ͍ͯ͠Δ? • Ͳͷަ௨ࣄނ͕࠷ौΛҾ͖ى͍ͯ͜͠Δ͔? 4
σʔλ͔Β༗ҙٛͳใΛݟ͚ͭΔํ๏ 5 Search Aggregations Visualization Machine Learning
t_900 - Dashboard New Add Save Open Share Options !
~ 3 years ago to ~ 3 years ago 900 - Actual 2013-09-18 00:00 2013-09-21 00:00 2013-09-24 00:00 2013-09-27 00:00 2013-09-30 00:00 2013-10-03 00:00 2013-10-06 00:00 2013-10-09 00:00 2013-10-12 00:00 0 1000000 2000000 3000000 4000000 5000000 6000000 7000000 8000000 Actual 900 - Moving Average 6000000 7000000 8000000 Moving Average Actual Anomaly " ҟৗݕͷνϟϨϯδ 6 1 3 2 4 2 2 2 2 week
ҠಈฏۉʹΑΔҟৗݕ 7 t_900 - Dashboard New Add Save Open Share
Options ! ~ 3 years ago to ~ 3 years ago 900 - Moving Average 2013-09-18 00:00 2013-09-21 00:00 2013-09-24 00:00 2013-09-27 00:00 2013-09-30 00:00 2013-10-03 00:00 2013-10-06 00:00 2013-10-09 00:00 2013-10-12 00:00 0 1000000 2000000 3000000 4000000 5000000 6000000 7000000 8000000 Moving Average Actual Anomaly 900 - Holt-Winters 8000000 9000000 HoltWinters Actual Anomaly "
)PMU8JOUFSTʹΑΔҟৗݕ 8 _900 - Dashboard New Add Save Open Share
Options ! ~ 3 years ago to ~ 3 years ago 900 - Holt-Winters 2013-09-18 00:00 2013-09-21 00:00 2013-09-24 00:00 2013-09-27 00:00 2013-09-30 00:00 2013-10-03 00:00 2013-10-06 00:00 2013-10-09 00:00 2013-10-12 00:00 0 1000000 2000000 3000000 4000000 5000000 6000000 7000000 8000000 9000000 HoltWinters Actual Anomaly ly timeline : detector Interval: Auto Sep 17 2013 Sep 19 2013 Sep 21 2013 Sep 23 2013 Sep 25 2013 Sep 27 2013 Sep 29 2013 Oct 1 2013 Oct 3 2013 Oct 5 2013 Oct 7 2013 Oct 9 2013 Oct 11 2013 non_zero_count "
1SFMFSUʹΑΔҟৗݕ 9 rer Jobs Summary view Explorer Connections Support !
" # $ September 15th 2013, 00:00:00.000 to October 13th All jobs * debug 900 Sep 17 2013 Sep 20 2013 Sep 23 2013 Sep 26 2013 Sep 29 2013 Oct 2 2013 Oct 5 2013 Oct 8 2013 Oct 11 2013 0 500000 1000000 1500000 2000000 Infl y timeline : detector Interval: Auto Sep 17 2013 Sep 20 2013 Sep 23 2013 Sep 26 2013 Sep 29 2013 Oct 2 2013 Oct 5 2013 Oct 8 2013 Oct 11 2013 non_zero_count All jobs * debug 900 Sep 17 2013 Sep 20 2013 Sep 23 2013 Sep 26 2013 Sep 29 2013 Oct 2 2013 Oct 5 2013 Oct 8 2013 Oct 11 2013 0 500000 1000000 1500000 2000000 Influ ly timeline : detector Interval: Auto Sep 17 2013 Sep 20 2013 Sep 23 2013 Sep 26 2013 Sep 29 2013 Oct 2 2013 Oct 5 2013 Oct 8 2013 Oct 11 2013 non_zero_count lies 1 3 2 4
ୈिͷΫϩʔζΞοϓ 10 orer Jobs Summary view Explorer Connections Support !
" # $ September 22nd 2013, 00:00:00.000 to September 29th 2 All jobs * l debug _900 Sep 22 09:00 Sep 22 21:00 Sep 23 09:00 Sep 23 21:00 Sep 24 09:00 Sep 24 21:00 Sep 25 09:00 Sep 25 21:00 Sep 26 09:00 Sep 26 21:00 Sep 27 09:00 Sep 27 21:00 Sep 28 09:00 Sep 28 21:00 0 500000 1000000 1500000 2000000 Influ aly timeline by: detector Interval: Auto Sep 22 09:00 Sep 22 21:00 Sep 23 09:00 Sep 23 21:00 Sep 24 09:00 Sep 24 21:00 Sep 25 09:00 Sep 25 21:00 Sep 26 09:00 Sep 26 21:00 Sep 27 09:00 Sep 27 21:00 Sep 28 09:00 Sep 28 21:00 non_zero_count 3 2
1SFMFSUͷςΫϊϩδʔ 11 σʔλʹજΉߦಈϞσϧΛ ࣗಈతʹڭࢣͳֶ͠श ݱࡏͷߦಈ͕༧ଌϞσϧͱ ݦஶʹҟͳΔ߹ʹ௨
Demo
%FNP*5ΦϖϨʔγϣϯ
%FNP*5ΦϖϨʔγϣϯ
%FNP*5ΦϖϨʔγϣϯ
%FNP*5ηΩϡϦςΟ
ϩʔυϚοϓ • ϕʔλ൛Λఏڙத (prelert.com) • Elastic StackͱͷڧݻͳΠϯςάϨʔγϣϯ͕ਐߦத • 2017্ظͷϦϦʔεΛඪ 17