1

I have roughly 1400 logs in my OpenSearch index. Roughly 835 are historical, and now I am continuously ingesting using Kinesis Firehose. Rows in my index

When I am creating a detector I am not able to preview this data, I get the following alert:

"No sample anomaly result generated. Please check the detector interval and make sure you have >400 data points during the preview date range."Error screenshot

My detector interval- is 3 minutes, window delay- is 1 minute, and window size- is 8.

My data is in the following format, Log data

Historical data can also be found here: Dataset

I did not get an anomaly here:

Feature Breakdown

I also have a template for my index:

PUT  _template/logs
{
    "index_patterns": ["logs*"],
    "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
    },
    "mappings": {
       "properties": {
          "timestamp": {
            "type": "date",
            "format": "epoch_second"
          }
      }
  }
}

This is the first time I am working with anomaly detectors not sure if this is expected or I am missing something.

Muskan
  • 11
  • 1

0 Answers0