Creating General Definition Information for Anomaly Detector
In the first stage, the identifying information of the job is entered. The most important field here is the environment information option. Queries and filters are executed on the log server in the selected environment information.
Creating Query
A query is created by combining specific fields (HTTP Method, Error Type, etc.) that will match log records with criteria of and / or / not types to create expected conditions. To create a new query, it is created from the Query section.
Creating Filter
Filters are applied together with queries. They contain the criteria that log records will match. To create a new filter, it is created from the Filter section.
Conditions
In the following condition, ‘count of documents’ will look at the request count. It will check if there is an increase of more than “50%” compared to the average. In this case, the “‘1 Result’” expression indicates that if the anomaly occurs only once, it will be considered as an anomaly.
Actions
When anomaly detection is performed, we can create an alert system. In this example, we will make it send an email when an anomaly occurs.
Save
In the final state, the information will appear as follows, and let’s make it ready for monitoring with the save button.
Examining Job Details
You can check with the Result option.
