{"id":35274,"date":"2019-10-31T22:03:22","date_gmt":"2019-10-31T19:03:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\/"},"modified":"2019-10-31T22:03:22","modified_gmt":"2019-10-31T19:03:22","slug":"razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","title":{"rendered":"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/8fe88b798a64e2ed8e77dbbc89558827.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAmintim c\u0103 Elastic Stack se bazeaz\u0103 pe o baz\u0103 de date nerelational\u0103 Elasticsearch, un interfa\u021b\u0103 web Kibana \u0219i colectoare-prelucr\u0103toare de date (cel mai cunoscut fiind Logstash, diverse Beats, APM \u0219i altele). Una dintre caracteristicile pl\u0103cute ale acestui set de produse este analiza datelor utiliz\u00e2nd algoritmi de \u00eenv\u0103\u021bare automat\u0103. \u00cen acest articol, explor\u0103m ce reprezint\u0103 ace\u0219ti algoritmi. V\u0103 rug\u0103m s\u0103 continua\u021bi.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u00cenv\u0103\u021barea automat\u0103 este o func\u021bie pl\u0103tit\u0103 a Elastic Stack, care face parte din pachetul X-Pack. Pentru a \u00eencepe utilizarea acesteia, este suficient s\u0103 activa\u021bi un trial de 30 de zile dup\u0103 instalare. Dup\u0103 expirarea perioadei de prob\u0103, pute\u021bi solicita suport pentru prelungire sau achizi\u021biona un abonament. Costul abonamentului este calculat nu \u00een func\u021bie de volumul de date, ci de num\u0103rul de noduri utilizate. Desigur, volumul de date influen\u021beaz\u0103 num\u0103rul de noduri necesare, dar totu\u0219i, o astfel de abordare a licen\u021bierii este mai uman\u0103 fa\u021b\u0103 de bugetul companiei. Dac\u0103 nu este necesar\u0103 o performan\u021b\u0103 ridicat\u0103, este posibil s\u0103 economisi\u021bi.<\/p>\n<p>ML \u00een Elastic Stack este scris \u00een C++ \u0219i func\u021bioneaz\u0103 \u00een afara JVM, \u00een care ruleaz\u0103 Elasticsearch. Asta \u00eenseamn\u0103 c\u0103 procesul (care se nume\u0219te autodetect) consum\u0103 tot ce nu poate fi preluat de JVM. \u00centr-un demo, acest lucru nu este at\u00e2t de critic, dar \u00een medii productive este important s\u0103 se aloce noduri separate pentru sarcinile de ML.<\/p>\n<p>Algoritmii de \u00eenv\u0103\u021bare automat\u0103 se \u00eempart \u00een dou\u0103 categorii \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9E%D0%B1%D1%83%D1%87%D0%B5%D0%BD%D0%B8%D0%B5_%D1%81_%D1%83%D1%87%D0%B8%D1%82%D0%B5%D0%BB%D0%B5%D0%BC\">cu \u00eenv\u0103\u021b\u0103tor<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9E%D0%B1%D1%83%D1%87%D0%B5%D0%BD%D0%B8%D0%B5_%D0%B1%D0%B5%D0%B7_%D1%83%D1%87%D0%B8%D1%82%D0%B5%D0%BB%D1%8F\">f\u0103r\u0103 \u00eenv\u0103\u021b\u0103tor<\/a><\/noindex>. \u00cen Elastic Stack, algoritmul face parte din categoria \u201ef\u0103r\u0103 \u00eenv\u0103\u021b\u0103tor\u201d. Pe baza <noindex><a rel=\"nofollow\" href=\"http:\/\/www.ijmlc.org\/papers\/398-LC018.pdf\">acest link<\/a><\/noindex> se pot vizualiza aparatele matematice ale algoritmilor de \u00eenv\u0103\u021bare automat\u0103.<\/p>\n<p>Pentru a efectua analiza, algoritmul de \u00eenv\u0103\u021bare automat\u0103 utilizeaz\u0103 datele stocate \u00een indexurile Elasticsearch. Sarcinile de analiz\u0103 pot fi create at\u00e2t din interfa\u021ba Kibana, c\u00e2t \u0219i prin intermediul API-ului. Dac\u0103 face\u021bi acest lucru prin intermediul Kibana, nu trebuie s\u0103 cunoa\u0219te\u021bi unele lucruri. De exemplu, indexurile suplimentare pe care le folose\u0219te algoritmul \u00een timpul func\u021bion\u0103rii. <\/p>\n<p><b class=\"spoiler_title\">Indexuri suplimentare utilizate \u00een procesul de analiz\u0103<\/b>.ml-state \u2014 informa\u021bii despre modelele statistice (set\u0103rile analizei);<br \/>\n.ml-anomalies-* \u2014 rezultatele activit\u0103\u021bii algoritmilor ML;<br \/>\n.ml-notifications \u2014 set\u0103rile de notificare \u00een leg\u0103tur\u0103 cu rezultatele analizei.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/a6a67b0c05c6650a158d99010c2872f1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nStructura datelor \u00een baza de date Elasticsearch const\u0103 \u00een indici \u0219i documentele stocate \u00een ace\u0219tia. Comparativ cu o baz\u0103 de date rela\u021bional\u0103, un index poate fi comparat cu schema unei baze de date, iar un document cu un \u00eenregistrare \u00eentr-un tabel. Aceast\u0103 compara\u021bie este condi\u021bionat\u0103 \u0219i a fost realizat\u0103 pentru a simplifica \u00een\u021belegerea materialului ulterior pentru cei care au auzit doar despre Elasticsearch.<\/p>\n<p>Prin API este disponibil\u0103 aceea\u0219i func\u021bionalitate ca \u0219i prin interfa\u021ba web, a\u0219a c\u0103 pentru o mai bun\u0103 ilustrare \u0219i \u00een\u021belegere a conceptelor, vom ar\u0103ta cum se configuraz\u0103 prin Kibana. \u00cen meniul din st\u00e2nga exist\u0103 o sec\u021biune de Machine Learning, unde se poate crea o nou\u0103 sarcin\u0103 (Job). \u00cen interfa\u021ba Kibana, aceasta arat\u0103 ca \u00een imaginea de mai jos. Acum vom analiza fiecare tip de sarcin\u0103 \u0219i vom ar\u0103ta tipurile de analize care pot fi configurate aici.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/c0c0bede29fbe38a72270d2128926122.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSingle Metric \u2014 analiza unei singure m\u0103suri, Multi Metric \u2014 analiza a dou\u0103 sau mai multe m\u0103suri. \u00cen ambele cazuri, fiecare m\u0103sur\u0103 este analizat\u0103 \u00eentr-un mediu izolat, adic\u0103 algoritmul nu ia \u00een considerare comportamentul m\u0103surilor analizate \u00een paralel, a\u0219a cum ar putea p\u0103rea \u00een cazul Multi Metric. Pentru a efectua un calcul \u021bin\u00e2nd cont de corela\u021bia diferitelor m\u0103suri, se poate aplica analiza Population. Iar Advanced \u2014 reprezint\u0103 ajust\u0103ri fine ale algoritmilor cu op\u021biuni suplimentare pentru sarcini specifice. <\/p>\n<h2>Single Metric<\/h2>\n<p>\nAnaliza modific\u0103rilor unei singure m\u0103suri este cel mai simplu lucru pe care \u00eel putem face aici. Dup\u0103 ap\u0103sarea butonului Create Job, algoritmul va c\u0103uta anomalii.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/d84d29539c3b97be7a15aac8708bc3be.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen c\u00e2mpul <i>Aggregation<\/i> se poate alege abordarea pentru c\u0103utarea anomaliilor. De exemplu, la <i>Min<\/i> vor fi considerate anomalii valorile sub cele tipice. Exist\u0103 <i>Max, High Mean, Low, Mean, Distinct<\/i> \u0219i altele. Descrierea tuturor func\u021biilor poate fi consultat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/current\/ml-functions.html\">la link<\/a><\/noindex>.<\/p>\n<p>\u00cen c\u00e2mpul <i>Field<\/i> se specific\u0103 c\u00e2mpul numeric din document, pe care \u00eel vom analiza.<\/p>\n<p>\u00cen c\u00e2mpul <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/blog\/explaining-the-bucket-span-in-machine-learning-for-elasticsearch\"><i>Bucket span<\/i><\/a><\/noindex> \u2014 granularitatea intervalelor pe linia de timp, pe care va fi efectuat\u0103 analiza. Se poate l\u0103sa la automat sau selecta manual. \u00cen imaginea de mai jos este dat un exemplu de granularitate prea mic\u0103 \u2014 este posibil s\u0103 rata\u021bi o anomalie. Cu aceast\u0103 setare, se poate schimba sensibilitatea algoritmului la anomalii.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/a2808c0b451703a50d74f7737332ea8b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDurata datelor colectate este un aspect cheie care influen\u021beaz\u0103 eficien\u021ba analizei. La analiz\u0103, algoritmul determin\u0103 intervalele repetate, calculeaz\u0103 intervalul de \u00eencredere (baze de referin\u021b\u0103) \u0219i identific\u0103 anomalii \u2014 abateri netipice de la comportamentul normal al m\u0103surii. Doar pentru exemplu:<\/p>\n<p>Liniile de baz\u0103 pentru un segment mic de date:<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/2a3cbeaa8cf08a2a5dec87071be27db8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAtunci c\u00e2nd algoritmul are de unde s\u0103 \u00eenve\u021be, liniile de baz\u0103 arat\u0103 a\u0219a:<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/13d636ab405a85d89e2ae4ebfe8bb6bd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDup\u0103 ce sarcina a fost lansat\u0103, algoritmul determin\u0103 devia\u021biile anormale de la norm\u0103 \u0219i le clasific\u0103 dup\u0103 probabilitatea anomaliilor (culoarea etichetei corespunz\u0103toare este indicat\u0103 \u00eentre paranteze):<\/p>\n<p>Avertisment (albastru): mai pu\u021bin de 25<br \/>\nMinor (galben): 25-50<br \/>\nMajor (portocaliu): 50-75<br \/>\nCritic (ro\u0219u): 75-100<\/p>\n<p>\u00cen graficul de mai jos, un exemplu cu anomalii g\u0103site.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/ed87198f99f0cc93ffc16ce458054a9f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAici vedem cifra 94, care reprezint\u0103 probabilitatea anomaliilor. Este clar c\u0103, av\u00e2nd \u00een vedere c\u0103 valoarea se apropie de 100, avem o anomalie. \u00cen coloana sub grafic este indicat\u0103 o probabilitate extrem de mic\u0103 de 0.000063634% pentru apari\u021bia acelor valori de metrice.<\/p>\n<p>Pe l\u00e2ng\u0103 c\u0103utarea anomaliilor \u00een Kibana, se poate lansa o prognoz\u0103. Acest lucru este realizat simplu din aceea\u0219i vizualizare cu anomalii \u2014 butonul <i>Prognoz\u0103<\/i> \u00een col\u021bul din dreapta sus.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/73429a947befb8834972ebbfe48c2d48.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrognoza se construie\u0219te pentru maximum 8 s\u0103pt\u0103m\u00e2ni \u00een avans. Chiar dac\u0103 se dore\u0219te, mai mult nu se poate din motive de design.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/7622608e4b952be741be486f89d1bc43.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen anumite situa\u021bii, prognoza va fi foarte util\u0103, de exemplu, atunci c\u00e2nd se urm\u0103re\u0219te \u00eenc\u0103rcarea utilizatorilor pe infrastructur\u0103.<\/p>\n<h2>Multi Metric<\/h2>\n<p>\nTrecem la urm\u0103toarea capacitate ML din Elastic Stack \u2014 analiza mai multor metrice simultan. Dar nu \u00eenseamn\u0103 c\u0103 va fi analizat\u0103 dependen\u021ba unei metrice de alta. Este identic cu Single Metric, doar c\u0103 acum sunt mai multe metrice pe un singur ecran pentru compararea u\u0219oar\u0103 a influen\u021bei unuia asupra altuia. Analiza dependen\u021bei unei metrice de alta va fi discutat\u0103 \u00een partea Population.<\/p>\n<p>Dup\u0103 ce a fost ap\u0103sat dreptunghiul cu Multi Metric, va ap\u0103rea o fereastr\u0103 cu set\u0103rile. Vom detalia acestea.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/eaa06c8b24b393209ef1fb5ba9cfbd62.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru \u00eenceput, trebuie s\u0103 selecta\u021bi c\u00e2mpurile pentru analiz\u0103 \u0219i agregarea datelor pe acestea. Op\u021biunile de agregare sunt acelea\u0219i ca pentru Single Metric (<i>Max, High Mean, Low, Mean, Distinct<\/i> \u0219i altele). Apoi, datele pot fi \u00eemp\u0103r\u021bite op\u021bional pe unul dintre c\u00e2mpuri (c\u00e2mpul <i>Split Data<\/i>). \u00cen exemplu, am f\u0103cut acest lucru pe c\u00e2mpul <i>OriginAirportID<\/i>. Observa\u021bi c\u0103 graficul metricei din dreapta este acum prezentat sub form\u0103 de mai multe grafice.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/746a91b28a010a037c66a569fcf47a1b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nC\u00e2mp <i>C\u00e2mpuri cheie (Influencers)<\/i> influenteaz\u0103 direct anomaliile g\u0103site. \u00cen mod implicit, aici va exista \u00eentotdeauna cel pu\u021bin o valoare, dar pute\u021bi ad\u0103uga altele suplimentare. Algoritmul va lua \u00een considerare influen\u021ba acestor c\u00e2mpuri \u00een analiza sa \u0219i va ar\u0103ta cele mai \u201einfluente\u201d valori.<\/p>\n<p>Dup\u0103 lansare, \u00een interfa\u021ba Kibana va ap\u0103rea aproximativ aceast\u0103 imagine.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/c6efd8f4815ad150b046c82780c36574.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAceasta este a\u0219a-numita hart\u0103 termic\u0103 a anomaliilor pentru fiecare valoare a c\u00e2mpului <i>OriginAirportID<\/i>, pe care l-am indicat \u00een <i>Split Data<\/i>. A\u0219a cum se \u00eent\u00e2mpl\u0103 cu Single Metric, culoarea indic\u0103 nivelul devia\u021biei anormale. O analiz\u0103 similar\u0103 poate fi realizat\u0103, de exemplu, pentru sta\u021biile de lucru pentru a urm\u0103ri cele care au un num\u0103r suspect de mari de autentific\u0103ri etc. Am mai scris <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/447522\/\">despre evenimente suspecte \u00een EventLog Windows<\/a><\/noindex>, care de asemenea pot fi adunate \u0219i analizate aici.<\/p>\n<p>Sub harta de c\u0103ldur\u0103 exist\u0103 o list\u0103 de anomalii, de unde fiecare poate fi accesat pentru a vizualiza Single Metric pentru analiza detaliat\u0103.<\/p>\n<h2>Population<\/h2>\n<p>\nPentru a c\u0103uta anomalii \u00eentre corela\u021biile dintre diferite metrici \u00een Elastic Stack exist\u0103 o analiz\u0103 specializat\u0103 numit\u0103 Population. Cu ajutorul acesteia se pot c\u0103uta valori anormale \u00een performan\u021ba unui server \u00een compara\u021bie cu altele, de exemplu, \u00een cazul cre\u0219terii num\u0103rului de cereri c\u0103tre sistemul \u021bint\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/00542d57f2a937d424b2db5e692a6289.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen aceast\u0103 ilustra\u021bie, c\u00e2mpul Population indic\u0103 valoarea la care se vor raporta metricile analizate. \u00cen acest caz, este numele procesului. Ca rezultat, vom vedea cum utilizarea procesorului de c\u0103tre fiecare dintre procese a influen\u021bat unii pe al\u021bii.<\/p>\n<p>Observa\u021bi c\u0103 graficul datelor analizate difer\u0103 de cazurile cu Single Metric \u0219i Multi Metric. Acest lucru este realizat \u00een Kibana pentru a \u00eembun\u0103t\u0103\u021bi percep\u021bia distribu\u021biei valorilor datelor analizate.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/4af704044bf544ca6cd221404288e6c4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDin grafic se observ\u0103 c\u0103 procesul s-a comportat anormal <i>stress<\/i> (de altfel, generat de o unealt\u0103 special\u0103) pe serverul <i>poipu<\/i>, care a influen\u021bat (sau a fost un influencer) asupra apari\u021biei acestei anomalii.<\/p>\n<h2>Avansat<\/h2>\n<p>\nAnaliza cu reglaj fin. La analiza Advanced \u00een Kibana apar set\u0103ri suplimentare. Dup\u0103 ap\u0103sarea \u00een meniul de creare pe placa Advanced, apare aceast\u0103 fereastr\u0103 cu tab-uri. Tab-ul <i>Job Details<\/i> a fost omis inten\u021bionat, acolo sunt set\u0103rile de baz\u0103 care nu se refer\u0103 direct la setarea analizei.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/abe7941ad56acf3ee7ab992fa5fe7b94.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen <i>summary_count_field_name<\/i> se poate specifica op\u021bional numele c\u00e2mpului din documente care con\u021bine valori agregate. \u00cen acest exemplu - num\u0103rul de evenimente pe minut. \u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/current\/ml-configuring-categories.html\"><i>categorization_field_name<\/i><\/a><\/noindex> se specific\u0103 numele c\u00e2mpului din document care con\u021bine o valoare variabil\u0103. Pe baza acestui c\u00e2mp se pot \u00eemp\u0103r\u021bi datele analizate \u00een submul\u021bimi. Observa\u021bi butonul <i>Add detector<\/i> \u00een ilustra\u021bia anterioar\u0103. Mai jos este rezultatul ap\u0103s\u0103rii acestui buton.<\/p>\n<p><img decoding=\"async\" alt=\"Facem clarific\u0103ri despre Machine Learning \u00een Elastic Stack (cunoscut \u0219i sub numele de Elasticsearch, ELK)\" src=\"\/wp-content\/uploads\/2019\/06\/cce9a6401d6baa72c68b8e0c3c6ab209.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAici este un bloc suplimentar de set\u0103ri pentru configurarea detectorului de anomalii pentru o anumit\u0103 sarcin\u0103. Cazurile de utilizare specifice (\u00een special legate de securitate) le vom analiza \u00een articolele urm\u0103toare. De exemplu, <noindex><a rel=\"nofollow\" href=\"https:\/\/discuss.elastic.co\/t\/dec-4th-2018-en-ml-rarity-analysis-with-machine-learning\/158979\">uita\u021bi-v\u0103 la<\/a><\/noindex> unul dintre cazurile discutate. Acesta este legat de identificarea valorilor rare \u0219i este realizat <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-rare-functions.html\">prin func\u021bia rare<\/a><\/noindex>.<\/p>\n<p>\u00cen c\u00e2mpul <i>function<\/i> pute\u021bi alege o func\u021bie specific\u0103 pentru c\u0103utarea anomaliilor. Pe l\u00e2ng\u0103 <i>rare<\/i>, exist\u0103 \u0219i c\u00e2teva func\u021bii interesante - <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-time-functions.html\"><i>time_of_day<\/i> \u0219i <i>time_of_week<\/i><\/a><\/noindex>. Acestea identific\u0103 anomalii \u00een comportamentul metricilor pe parcursul zilei sau s\u0103pt\u0103m\u00e2nii, respectiv. Alte func\u021bii de analiz\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack-overview\/7.1\/ml-functions.html\">sunt disponibile \u00een documenta\u021bie<\/a><\/noindex>.<\/p>\n<p>\u00cen <i>field_name<\/i> se specific\u0103 c\u00e2mpul documentului pe care se va face analiza. <i>By_field_name<\/i> poate fi folosit pentru a separa rezultatele analizei \u00een func\u021bie de fiecare valoare specificat\u0103 a c\u00e2mpului documentului. Dac\u0103 completa\u021bi <i>over_field_name<\/i> se va efectua o analiz\u0103 a popula\u021biei, pe care am discutat-o anterior. Dac\u0103 se specific\u0103 o valoare \u00een <i>partition_field_name<\/i>, atunci pe acest c\u00e2mp al documentului vor fi calculate linii de baz\u0103 separate pentru fiecare valoare (exemplu de valoare poate fi numele serverului sau al procesului pe server). \u00cen <i>exclude_frequent<\/i> pute\u021bi alege <i>all<\/i> sau <i>none<\/i>, ceea ce va \u00eensemna excluderea (sau includerea) valorilor frecvente ale c\u00e2mpurilor documentelor.<\/p>\n<p>\u00cen articol, am \u00eencercat s\u0103 oferim o prezentare c\u00e2t mai concis\u0103 a capacit\u0103\u021bilor \u00eenv\u0103\u021b\u0103rii automate \u00een Elastic Stack, r\u0103m\u00e2n\u00e2nd nenegociat \u00eenc\u0103 multe detalii. V\u0103 rug\u0103m s\u0103 ne spune\u021bi \u00een comentarii ce cazuri a\u021bi reu\u0219it s\u0103 rezolva\u021bi cu ajutorul Elastic Stack \u0219i pentru ce sarcini \u00eel utiliza\u021bi. Pentru a lua leg\u0103tura cu noi, pute\u021bi folosi mesaje personale pe Habr sau <noindex><a rel=\"nofollow\" href=\"https:\/\/gals.software\/solutions\/elasticstack\">formularul de feedback de pe site<\/a><\/noindex>.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/galssoftware\/blog\/455387\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0432 \u043e\u0441\u043d\u043e\u0432\u0435 Elastic Stack \u043b\u0435\u0436\u0430\u0442 \u043d\u0435\u0440\u0435\u043b\u044f\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 Elasticsearch, \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 Kibana \u0438 \u0441\u0431\u043e\u0440\u0449\u0438\u043a\u0438-\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0441\u0430\u043c\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 Logstash, \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 Beats, APM \u0438 \u0434\u0440\u0443\u0433\u0438\u0435). \u041e\u0434\u043d\u043e \u0438\u0437 \u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0439 \u0432\u0441\u0435\u0433\u043e \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0441\u0442\u0435\u043a\u0430 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u2014 \u0430\u043d\u0430\u043b\u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 \u043c\u0430\u0448\u0438\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0447\u0442\u043e \u0438\u0437 \u0441\u0435\u0431\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442 \u044d\u0442\u0438 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u044b. \u041f\u0440\u043e\u0441\u0438\u043c \u043f\u043e\u0434 \u043a\u0430\u0442. \u041c\u0430\u0448\u0438\u043d\u043d\u043e\u0435 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26487,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0441 Machine Learning \u0432 Elastic Stack (\u043e\u043d \u0436\u0435 Elasticsearch, \u043e\u043d \u0436\u0435 ELK) | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:03:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:03:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Explor\u0103m Machine Learning \u00een Elastic Stack (de asemenea, Elasticsearch, de asemenea, ELK) | ProHoster","description":"Reamintim.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c\u0441\u044f \u0441 Machine Learning \u0432 Elastic Stack (\u043e\u043d \u0436\u0435 Elasticsearch, \u043e\u043d \u0436\u0435 ELK) | ProHoster","og:description":"\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/razbiraemsya-s-machine-learning-v-elastic-stack-on-zhe-elasticsearch-on-zhe-elk","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:22+00:00","article:modified_time":"2019-10-31T19:03:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35274","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:37:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:07:28","updated":"2026-01-21 22:37:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35274"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/26487"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}