Visualizing Anomalies in Kibana 7.6

2.5 hours
  • 3 Learning Objectives

About this Hands-on Lab

Using Kibana visualizations and dashboards, we can spot anomalies in our data but only if we are very intimately familiar with the data. However, with Kibana’s anomaly detection, we can find unusual data points more quickly and easily than we could by ourselves. Combining the output of anomaly detection machine learning jobs with our visualizations, we can annotate what’s normal, and what’s not, in real time, without having an intimate knowledge of the dataset. In this hands-on lab, we will explore the annotation ability of the TSVB in Kibana to display anomalous behavior over our time series visualizations.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Create and run the ecommerce-sales ML job.
  1. Create a single-metric anomaly detection machine learning job for the ecommerce index pattern.
  2. Use the full flights data as the time range.
  3. Configure the job to analyze the sum of products.price.
  4. Configure the bucket span to be 30 minutes.
  5. Configure the job to ignore sparse data.
  6. Set the job ID to ecommerce-sales.
  7. Create and configure the job to run in realtime.
Create and save the Sales Over Time visualization.
  1. Create the .ml-anomalies-shared index pattern in order to access the anomaly data.
  2. Create a new TSVB time-series visualization for the ecommerce index pattern.
  3. Configure the series to calculate the sum of the products.price field, label it as Sales, and display it as a dollar amount with 2 decimal places (example: 1,234.567 as $1,234.56).
  4. Configure the visualization to hide the legend.
  5. Add an annotation that displays a red line with an exclamation triangle icon whenever an anomaly with a record_score greater than or equal to 50 occurs for the ecommerce-sales machine learning job.
  6. Configure the annotation’s tooltip to display the record_score, typical, and actual values of the anomaly.
  7. Save the visualization as Sales Over Time.
Add the Sales Over Time visualization to the eCommerce dashboard.
  1. Edit the eCommerce dashboard.
  2. Add the Sales Over Time visualization and place it wherever you like.
  3. Save the dashboard.

Additional Resources

You work as a data analyst for an international online clothing store. You have been tasked with creating the following machine learning job to monitor anomalous changes in sales:

  • Create a single-metric anomaly detection machine learning job for the ecommerce index pattern.
  • Use the full flights data as the time range.
  • Configure the job to analyze the sum of products.price.
  • Configure the bucket span to be 30 minutes.
  • Configure the job to ignore sparse data.
  • Set the job ID to ecommerce-sales.
  • Create and configure the job to run in realtime.

Once the ecommerce-sales job has been creating and is running, you need to create the following Time Series Visual Builder (TSVB) visualization to track the anomalies overtop of a sales aggregation:

  • Create the .ml-anomalies-shared index pattern in order to access the anomaly data.
  • Create a new TSVB time-series visualization for the ecommerce index pattern.
  • Configure the series to calculate the sum of the products.price field, label it as Sales, and display it as a dollar amount with 2 decimal places (example: 1,234.567 as $1,234.56).
  • Configure the visualization to hide the legend.
  • Add an annotation that displays a red line with an exclamation triangle icon whenever an anomaly with a record_score greater than or equal to 50 occurs for the ecommerce-sales machine learning job.
  • Configure the annotation's tooltip to display the record_score, typical, and actual values of the anomaly.
  • Save the visualization as Sales Over Time.

Once you have the Sales Over Time visualization saved, you need to add it to the eCommerce dashboard.

Your lab node node has an Kibana instance which can be accessed in your local web browser by navigating to the public IP address of the lab node over port 8080 (example: http://public_ip:8080). To log in, use the elastic user with the password elastic_acg.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Sign In
Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started
Who’s going to be learning?