{"id":35274,"date":"2019-10-31T22:03:22","date_gmt":"2019-10-31T19:03:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\/"},"modified":"2019-10-31T22:03:22","modified_gmt":"2019-10-31T19:03:22","slug":"razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","title":{"rendered":"Uurime Machine Learning'i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/8fe88b798a64e2ed8e77dbbc89558827.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTuletame meelde, et Elastic Stacki alus on mitte-suhteandmebaas Elasticsearch, veebiliides Kibana ja andmete t\u00f6\u00f6tlemise kogujad (k\u00f5ige tuntumad on Logstash, erinevad Beats, APM ja teised). \u00dcks meeldiv lisa kogu sellele tootehulgale on andmete anal\u00fc\u00fcs masin\u00f5ppe algoritmide abil. Selles artiklis tutvume nende algoritmidega. Palun vaata allapoole.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nMasin\u00f5pe on tasuline funktsioon tinglikult tasuta Elastic Stackis ja kuulub X-Packi paketisse. Selle kasutamiseks piisab, kui aktiveerida p\u00e4rast installimist 30-p\u00e4evane prooviversioon. Prooviperioodi l\u00f5ppedes saab taotleda toe pikendamist v\u00f5i osta tellimust. Tellimuse hind ei arvestata andmehulga j\u00e4rgi, vaid kasutatavaid s\u00f5lmi. Jah, andmehulga suurus m\u00f5jutab kindlasti vajalike s\u00f5lmede arvu, kuid selline litsentseerimise l\u00e4henemine on ettev\u00f5tte eelarve suhtes m\u00e4rksa humanitaarsem. Kui k\u00f5rge j\u00f5udlus pole vajalik, saab ka s\u00e4\u00e4sta.<\/p>\n<p>Elastic Stacki masin\u00f5pe on kirjutatud C++-s ja t\u00f6\u00f6tab v\u00e4ljaspool JVM-i, kus t\u00f6\u00f6tab ka Elasticsearch. See t\u00e4hendab, et protsess (mida muide nimetatakse autodetekteerimiseks) kasutab k\u00f5ike, mida JVM ei suuda t\u00f6\u00f6delda. Demovariandis ei ole see nii kriitiline, kuid tootmisolukordades on oluline eraldada masin\u00f5ppe \u00fclesannete jaoks eraldi s\u00f5lmed.<\/p>\n<p>Masin\u00f5ppe algoritmid jagunevad kaheks kategooriaks \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9E%D0%B1%D1%83%D1%87%D0%B5%D0%BD%D0%B8%D0%B5_%D1%81_%D1%83%D1%87%D0%B8%D1%82%D0%B5%D0%BB%D0%B5%D0%BC\">\u00f5petusega<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9E%D0%B1%D1%83%D1%87%D0%B5%D0%BD%D0%B8%D0%B5_%D0%B1%D0%B5%D0%B7_%D1%83%D1%87%D0%B8%D1%82%D0%B5%D0%BB%D1%8F\">ilma \u00f5petuseta<\/a><\/noindex>. Elastic Stackis on algoritm kategoriiast \"ilma \u00f5petuseta\". Matemaatikale tuginevaid masin\u00f5ppe algoritme saab vaadata, <noindex><a rel=\"nofollow\" href=\"http:\/\/www.ijmlc.org\/papers\/398-LC018.pdf\">sellel lingil<\/a><\/noindex> matemaatiliste algoritmide kohta.<\/p>\n<p>Anal\u00fc\u00fcsi l\u00e4biviimiseks kasutab masin\u00f5ppe algoritm andmeid, mis on salvestatud Elasticsearchi indeksitesse. Anal\u00fc\u00fcsit\u00f6\u00f6de loomine on v\u00f5imalik nii Kibana liidesest kui ka API kaudu. Kui seda teha Kibana kaudu, ei pea te paljusid asju teadma. N\u00e4iteks t\u00e4iendavad indeksid, mida algoritm t\u00f6\u00f6protsessis kasutab. <\/p>\n<p><b class=\"spoiler_title\">T\u00e4iendavad indeksid, mida kasutatakse anal\u00fc\u00fcsi k\u00e4igus<\/b>.ml-state \u2014 teave statistiliste mudelite (anal\u00fc\u00fcsiseadistuste) kohta;<br \/>\n.ml-anomalies-* \u2014 masin\u00f5ppe algoritmide tulemused;<br \/>\n.ml-notifications \u2014 teavitamise seaded anal\u00fc\u00fcsi tulemuste kohta.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/a6a67b0c05c6650a158d99010c2872f1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nElasticsearchi andmeehitus koosneb indeksitest ja nendes hoitavatest dokumentidest. Kui v\u00f5rrelda relatsioonilise andmebaasiga, siis indeksit v\u00f5ib v\u00f5rrelda andmebaasi skeemiga, samas kui dokument vastab tabeli reale. See v\u00f5rdlus on tingimuslik ja on esitatud, et lihtsustada edasise materjali m\u00f5istmist neile, kes on Elasticsearchist vaid kuulnud.<\/p>\n<p>API kaudu on saadaval sama funktsionaalsus, mis veebiliidese kaudu, seega, et n\u00e4idata kontseptsioonide seadistamist, vaatame, kuidas seadistada l\u00e4bi Kibana. Vasakul men\u00fc\u00fcs on jaotis Machine Learning, kus saab luua uue \u00fclesande (Job). Kibana liideses n\u00e4eb see v\u00e4lja nagu alloleval pildil. Praegu k\u00e4sitleme iga \u00fclesande t\u00fc\u00fcpi ja n\u00e4itame anal\u00fc\u00fcsi vorme, mida siin saab konstruida.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/c0c0bede29fbe38a72270d2128926122.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSingle Metric \u2014 \u00fche metri anal\u00fc\u00fcs, Multi Metric \u2014 kahe v\u00f5i enama metri anal\u00fc\u00fcs. M\u00f5lemal juhul anal\u00fc\u00fcsitakse iga metri eraldi, st algoritm ei arvesta samal ajal anal\u00fc\u00fcsitavate metrikate k\u00e4itumist, nagu v\u00f5iks Multi Metric korral tunduda. Erinevate metrikate korrelatsiooni arvesse v\u00f5tmiseks saab rakendada populatsiooni anal\u00fc\u00fcsi. Advanced \u2014 see on algoritmide peenh\u00e4\u00e4lestamine t\u00e4iendavate valikutega spetsiifiliste \u00fclesannete jaoks. <\/p>\n<h2>Single Metric<\/h2>\n<p>\n\u00dche ainulaadse metri muutuste anal\u00fc\u00fcs on k\u00f5ige lihtsam, mida siin teha saab. P\u00e4rast Create Job nuppu vajutamist otsib algoritm anomaaliaid.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/d84d29539c3b97be7a15aac8708bc3be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00e4ljal <i>Aggregation<\/i> saab valida anomaaliate otsimise l\u00e4henemise. N\u00e4iteks, kui <i>Min<\/i> peetakse anomaaliateks v\u00e4\u00e4rtusi, mis on madalamad t\u00fc\u00fcpilistest. On olemas <i>Max, High Mean, Low, Mean, Distinct<\/i> ja teised. K\u00f5iki funktsioone saab vaadata <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/current\/ml-functions.html\">linki pidi<\/a><\/noindex>.<\/p>\n<p>V\u00e4ljal <i>Field<\/i> moodustab numbrilise v\u00e4li dokumendis, mille p\u00f5hjal teeme anal\u00fc\u00fcsi.<\/p>\n<p>V\u00e4ljal <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/blog\/explaining-the-bucket-span-in-machine-learning-for-elasticsearch\"><i>Bucket span<\/i><\/a><\/noindex> \u2014 ajaskaalal anal\u00fc\u00fcsimiseks valitud intervallide t\u00e4psus. V\u00f5id usaldada automaatikat v\u00f5i valida k\u00e4sitsi. Alloleval pildil on toodud n\u00e4ide liiga madalast t\u00e4psusest \u2014 v\u00f5id anomaalia maha magada. Selle seadistusega saab muuta algoritmi tundlikkust anomaaliate suhtes.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/a2808c0b451703a50d74f7737332ea8b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKogutud andmete kestus on peamine asi, mis m\u00f5jutab anal\u00fc\u00fcsi efektiivsust. Anal\u00fc\u00fcsi k\u00e4igus m\u00e4\u00e4rab algoritm korduvad intervallid, arvutab usaldusinterval (p\u00f5hilinid) ja tuvastab anomaaliad \u2014 ebat\u00fc\u00fcpilised k\u00f5rvalekalded tavap\u00e4rasest metri k\u00e4itumisest. Lihtsa n\u00e4itena:<\/p>\n<p>P\u00f5hijooned v\u00e4ikese andmeosa puhul:<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/2a3cbeaa8cf08a2a5dec87071be27db8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKui algoritmil on, millelt \u00f5ppida \u2014 n\u00e4evad p\u00f5hijooned v\u00e4lja nii:<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/13d636ab405a85d89e2ae4ebfe8bb6bd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00e4rast \u00fclesande k\u00e4ivitamist m\u00e4\u00e4rab algoritm normist k\u00f5rvalekaldumisi ja j\u00e4rjestab need t\u00f5en\u00e4osuse j\u00e4rgi (nende vastavate siltide v\u00e4rv on n\u00e4idatud sulgudes):<\/p>\n<p>Warning (sinine): alla 25<br \/>\nMinor (kollane): 25-50<br \/>\nMajor (oran\u017e): 50-75<br \/>\nCritical (punane): 75-100<\/p>\n<p>Alloleval graafikul n\u00e4ide leitud k\u00f5rvalekaldumistest.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/ed87198f99f0cc93ffc16ce458054a9f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSiin on number 94, mis t\u00e4histab k\u00f5rvalekalde t\u00f5en\u00e4osust. Selge on, et kuna v\u00e4\u00e4rtus on l\u00e4hedane 100-le, siis on meil t\u00f5epoolest k\u00f5rvalekalle. Graafiku all olevas veerus on n\u00e4idatud ebatavaliselt madal t\u00f5en\u00e4osus 0.000063634% selle m\u00f5\u00f5tme v\u00e4\u00e4rtuse ilmumiseks.<\/p>\n<p>Lisaks k\u00f5rvalekallete leidmisele Kibanas saab k\u00e4ivitada ka prognooside koostamise. Seda on lihtne teha ja sama anomaaliate vaate kaudu \u2014 nupp <i>Forecast<\/i> paremas \u00fclanurgas.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/73429a947befb8834972ebbfe48c2d48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrognoos koostatakse maksimaalselt 8 n\u00e4dala v\u00f5rra ette. Isegi kui v\u00e4ga sooviks \u2014 rohkem ei saa, see on disaini osa.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/7622608e4b952be741be486f89d1bc43.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTeatud olukordades on prognoos v\u00e4ga kasulik, n\u00e4iteks kui j\u00e4lgitakse kasutajakoormust infrastruktuurile.<\/p>\n<h2>Multi Metric<\/h2>\n<p>\nLiigume j\u00e4rgmise ML v\u00f5imaluse juurde Elastic Stackis \u2014 mitme m\u00f5\u00f5tme samal ajal anal\u00fc\u00fcs. Kuid see ei t\u00e4henda, et anal\u00fc\u00fcsitakse \u00fche m\u00f5\u00f5tme s\u00f5ltuvust teisest. See on sama, mis Single Metric, lihtsalt mitme m\u00f5\u00f5tme jaoks \u00fchel ekraanil mugavuse huvides, et v\u00f5rrelda \u00fcksteise m\u00f5ju. \u00dche m\u00f5\u00f5tme s\u00f5ltuvuse anal\u00fc\u00fcsimisest r\u00e4\u00e4gime jaotises Population.<\/p>\n<p>P\u00e4rast Multi Metrici ruudule klikimist ilmub seadistuste aken. Neid peatume \u00fcksikasjalikumalt.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/eaa06c8b24b393209ef1fb5ba9cfbd62.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEsmalt tuleb valida anal\u00fc\u00fcsimiseks v\u00e4ljad ja andmete agregatsioon nende j\u00e4rgi. Agregatsiooniv\u00f5imalused on samad, mis Single Metrici puhul (<i>Max, High Mean, Low, Mean, Distinct<\/i> ja muud). Edasi jagatakse andmed soovi korral \u00fche v\u00e4lja j\u00e4rgi (v\u00e4li <i>Split Data<\/i>). N\u00e4ites oleme seda teinud v\u00e4lja <i>OriginAirportID<\/i>. Pange t\u00e4hele, et paremal k\u00f5rvalekallete graafik on n\u00fc\u00fcd esitatud hulga graafikute kujul.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/746a91b28a010a037c66a569fcf47a1b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00e4li <i>Key Fields (Influencers)<\/i> m\u00f5jutavad otseselt leitud k\u00f5rvalekaldeid. Vaikimisi on siin alati v\u00e4hemalt \u00fcks v\u00e4\u00e4rtus, kuid saate lisada t\u00e4iendavaid. Algoritm arvestab nende v\u00e4ljade m\u00f5ju anal\u00fc\u00fcsi k\u00e4igus ja n\u00e4itab k\u00f5ige \u201em\u00f5julisemaid\u201d v\u00e4\u00e4rtusi.<\/p>\n<p>P\u00e4rast k\u00e4ivitamist ilmub Kibana kasutajaliideses enam-v\u00e4hem selline pilt.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/c6efd8f4815ad150b046c82780c36574.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSee on nn anomaaliate soojuskaart iga v\u00e4lja kohta <i>OriginAirportID<\/i>, mille me m\u00e4\u00e4rasime <i>Split Data<\/i>. Nagu ka Single Metric puhul, v\u00e4rv n\u00e4itab ebanormaalse k\u00f5rvalekalde taset. Sarnast anal\u00fc\u00fcsi on mugav teha n\u00e4iteks t\u00f6\u00f6jaamade puhul, et j\u00e4lgida neid, kus on kahtlaselt palju autentimisi jne. Oleme juba kirjutanud <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">kahtlastest s\u00fcndmustest EventLog Windowsis<\/a><\/noindex>, mida saab samuti siia koguda ja anal\u00fc\u00fcsida.<\/p>\n<p>Soojuskaardi all on anomaaliate loetelu, millest igast saab minna Single Metric vaatesse detailanal\u00fc\u00fcsiks.<\/p>\n<h2>Populatsioon<\/h2>\n<p>\nEbanormaalsete korrelatsioonide otsimiseks erinevate metrikate vahel Elastic Stackis on spetsialiseerunud populatsiooni anal\u00fc\u00fcs. Kui suurendada n\u00f5udluse arvu sihts\u00fcsteemile, saab selle abil otsida ebanormaalseid v\u00e4\u00e4rtusi mingi serveri j\u00f5udluses v\u00f5rreldes teistega.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/00542d57f2a937d424b2db5e692a6289.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSelles illustratsioonis on populatsiooni v\u00e4ljas n\u00e4idatud v\u00e4\u00e4rtus, millega anal\u00fc\u00fcsitavad metrikad seonduvad. Antud juhul on see protsessi nimi. Tulemuseks n\u00e4eme, kuidas iga protsessi protsessorikoormus omavahel m\u00f5jutas.<\/p>\n<p>Pange t\u00e4hele, et anal\u00fc\u00fcsitavate andmete graafik erineb Single Metric ja Multi Metric juhtudest. See on tehtud Kibana's disainitud viisil, et parandada anal\u00fc\u00fcsitavate andmete v\u00e4\u00e4rtuste jaotuse tajumist.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/4af704044bf544ca6cd221404288e6c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGraafikult on n\u00e4ha, et protsess toimis ebanormaalselt <i>stress<\/i> (mille t\u00f5i esile spetsiaalne utiliit) serveris <i>poipu<\/i>, mis m\u00f5jutas (v\u00f5i oli m\u00f5jutaja) selle anomaalia tekkimist.<\/p>\n<h2>Advanced<\/h2>\n<p>\nT\u00e4pne anal\u00fc\u00fctika. Advanced anal\u00fc\u00fcsis kuvatakse Kibana's t\u00e4iendavad seaded. P\u00e4rast loomise men\u00fc\u00fc tile Advanced klikkimist avaneb selline aken vahekategooriatega. Kategooriat <i>Job Details<\/i> j\u00e4eti tahtlikult vahele, seal on p\u00f5hiseaded, mis ei ole otseselt seotud anal\u00fc\u00fcsi seadistamisega.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/abe7941ad56acf3ee7ab992fa5fe7b94.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUues <i>summary_count_field_name<\/i> v\u00f5ib valikuliselt t\u00e4psustada dokumentide v\u00e4ljal, mis sisaldab agreggeeritud v\u00e4\u00e4rtusi. Selles n\u00e4ites \u2014 s\u00fcndmuste arv minutis. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/current\/ml-configuring-categories.html\"><i>categorization_field_name<\/i><\/a><\/noindex> mille puhul m\u00e4\u00e4ratakse dokumendi v\u00e4lja nimi, mis sisaldab mingit muutuvat v\u00e4\u00e4rtust. Selle v\u00e4lja mustri j\u00e4rgi saab anal\u00fc\u00fcsitavaid andmeid jagada alagruppideks. Pange t\u00e4hele nuppu <i>Add detector<\/i> eelnevas illustratsioonis. Allpool on n\u00e4ha tulemused, kui sellele nupule vajutada.<\/p>\n<p><img decoding=\"async\" alt=\"Uurime Machine Learning&#039;i Elastic Stackis (tuntud ka kui Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/cce9a6401d6baa72c68b8e0c3c6ab209.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSiin on t\u00e4iendav seadistuste plokk anomaaliade tuvastaja kohandamiseks konkreetse \u00fclesande jaoks. Konkreetseid kasutusjuhtumeid (eriti turvalisuse osas) kavatseme arutada j\u00e4rgmistes artiklites. N\u00e4iteks, <noindex><a rel=\"nofollow\" href=\"https:\/\/discuss.elastic.co\/t\/dec-4th-2018-en-ml-rarity-analysis-with-machine-learning\/158979\">vaadake<\/a><\/noindex> \u00fcht anal\u00fc\u00fcsitud juhtumit. See on seotud harvaesinevate v\u00e4\u00e4rtuste otsimisega ja rakendatakse <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-rare-functions.html\">funktsiooni rare<\/a><\/noindex>.<\/p>\n<p>V\u00e4ljal <i>function<\/i> v\u00f5ite valida konkreetse funktsiooni anomaaliade otsimise jaoks. Lisaks <i>rare<\/i>, on veel paar huvitavat funktsiooni \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-time-functions.html\"><i>time_of_day<\/i> ja <i>time_of_week<\/i><\/a><\/noindex>. Need tuvastavad aheldumisi metrikate k\u00e4itumises p\u00e4eva v\u00f5i n\u00e4dala jooksul vastavalt. \u00dclej\u00e4\u00e4nud anal\u00fc\u00fcsifunktsioonid <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-functions.html\">leidub dokumentatsioonis<\/a><\/noindex>.<\/p>\n<p>Uues <i>field_name<\/i> m\u00e4rgib dokumenti v\u00e4lja, mille alusel anal\u00fc\u00fcs toimub. <i>By_field_name<\/i> v\u00f5ib kasutada anal\u00fc\u00fcsi tulemuste jagamiseks iga eraldi v\u00e4\u00e4rtuse p\u00f5hjal, mida antud v\u00e4lja dokumentis kuvab. Kui t\u00e4ita <i>over_field_name<\/i> saadakse population-anal\u00fc\u00fcs, millest r\u00e4\u00e4kisime varem. Kui m\u00e4\u00e4rata v\u00e4\u00e4rtus <i>partition_field_name<\/i>, siis selle v\u00e4lja p\u00f5hjal arvutatakse eraldi alusjooned iga v\u00e4\u00e4rtuse jaoks (v\u00e4\u00e4rtusena v\u00f5ivad esineda n\u00e4iteks serveri v\u00f5i serveril t\u00f6\u00f6tava protsessi nimed). <i>exclude_frequent<\/i> saab valida <i>all<\/i> v\u00f5i <i>none<\/i>, mis t\u00e4hendab, et sagedasti esinevaid dokumendi v\u00e4ljade v\u00e4\u00e4rtusi v\u00e4listatakse (v\u00f5i lisatakse).<\/p>\n<p>Artiklis p\u00fc\u00fcdsime v\u00f5imalikult l\u00fchidalt anda \u00fclevaate masin\u00f5ppe v\u00f5imalustest Elastic Stackis, samas j\u00e4i palju detaile kajastamata. Jagage kommentaarides, milliseid juhtumeid olete Elastic Stacki abil lahendanud ja milliste \u00fclesannete jaoks seda kasutate. Meiega \u00fchenduse v\u00f5tmiseks v\u00f5ite kasutada isiklikke s\u00f5numeid Habr's v\u00f5i <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/solutions\/elasticstack\">tagasisidevormi meie veebisaidil<\/a><\/noindex>.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/455387\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0432 \u043e\u0441\u043d\u043e\u0432\u0435 Elastic Stack \u043b\u0435\u0436\u0430\u0442 \u043d\u0435\u0440\u0435\u043b\u044f\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Elasticsearch, \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 Kibana \u0438 \u0441\u0431\u043e\u0440\u0449\u0438\u043a\u0438-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0441\u0430\u043c\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 Logstash, \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 Beats, APM \u0438 \u0434\u0440\u0443\u0433\u0438\u0435). \u041e\u0434\u043d\u043e \u0438\u0437 \u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u0432\u0441\u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u2014 \u0430\u043d\u0430\u043b\u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0447\u0442\u043e \u0438\u0437 \u0441\u0435\u0431\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u044d\u0442\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u044b. \u041f\u0440\u043e\u0441\u0438\u043c \u043f\u043e\u0434 \u043a\u0430\u0442. \u041c\u0430\u0448\u0438\u043d\u043d\u043e\u0435 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26487,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0441 Machine Learning \u0432 Elastic Stack (\u043e\u043d \u0436\u0435 Elasticsearch, \u043e\u043d \u0436\u0435 ELK) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:03:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:03:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uurime masin\u00f5pet Elastic Stackis (tuntud ka kui Elasticsearch, ELK) | ProHoster","description":"Kinnitame.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0441 Machine Learning \u0432 Elastic Stack (\u043e\u043d \u0436\u0435 Elasticsearch, \u043e\u043d \u0436\u0435 ELK) | ProHoster","og:description":"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:22+00:00","article:modified_time":"2019-10-31T19:03:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35274","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:37:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:07:28","updated":"2026-01-21 22:37:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35274"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/26487"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}