Machine learning anomaly detection in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Elasticsearch anomaly detection query?

Given the following Elasticsearch ML anomaly detection job query, what will be the value of is_anomaly for the bucket with anomaly_score 85?

Elasticsearch

{
  "job_id": "network_traffic",
  "start": "now-1h",
  "end": "now",
  "anomaly_score": 85
}

A is_anomaly = true because anomaly_score > 75

B is_anomaly = false because anomaly_score < 90

C is_anomaly = true because anomaly_score > 90

D is_anomaly = false because anomaly_score < 50

💡 Hint

Elasticsearch flags anomalies when the anomaly score is above 75.

In Elasticsearch ML, anomaly scores above 75 are considered significant anomalies, so is_anomaly is true for a score of 85.

❓ data_output

intermediate

How many anomaly records are returned by this query?

Consider an Elasticsearch ML anomaly detection job that returns the following JSON snippet of anomalies detected in the last day. How many anomalies have an anomaly_score greater than 80?

Elasticsearch

{
  "anomalies": [
    {"timestamp": 1680000000000, "anomaly_score": 82},
    {"timestamp": 1680003600000, "anomaly_score": 77},
    {"timestamp": 1680007200000, "anomaly_score": 90},
    {"timestamp": 1680010800000, "anomaly_score": 65}
  ]
}

A 3

B 2

C 1

D 4

💡 Hint

Count only anomalies with anomaly_score strictly greater than 80.

Only two anomalies have scores above 80: 82 and 90.

🔧 Debug

advanced

What error does this Elasticsearch ML job configuration cause?

Review this ML job configuration snippet. What error will Elasticsearch return when trying to create this job?

Elasticsearch

{
  "job_id": "cpu_usage",
  "analysis_config": {
    "bucket_span": "15m",
    "detectors": [
      {"function": "mean", "field": "cpu_percent"},
      {"function": "sum", "field": "cpu_percent"}
    ]
  },
  "data_description": {"time_field": "timestamp"}
}

A Error: Invalid bucket_span format

B Error: Missing required field 'influencers'

C Error: Multiple detectors with the same field and incompatible functions

D No error, job created successfully

💡 Hint

Check if the combination of detectors is allowed in Elasticsearch ML.

Elasticsearch ML allows multiple detectors on the same field with different functions like mean and sum in the same job.

🚀 Application

advanced

Which option correctly filters anomalies with high severity in Elasticsearch ML results?

You want to filter anomaly detection results to show only anomalies with anomaly_score greater than 90. Which Elasticsearch query snippet achieves this?

A { "query": { "range": { "anomaly_score": { "gt": 90 } } } }

B { "query": { "term": { "anomaly_score": 90 } } }

C { "query": { "exists": { "field": "anomaly_score" } } }

D { "query": { "match": { "anomaly_score": ">90" } } }

💡 Hint

Use a range query to filter numeric fields.

The range query with "gt": 90 correctly filters anomalies with scores greater than 90.

🧠 Conceptual

expert

What is the primary advantage of using machine learning anomaly detection in Elasticsearch over static threshold alerts?

Choose the best explanation for why Elasticsearch ML anomaly detection is preferred over fixed threshold alerts in monitoring data streams.

A Static thresholds can detect anomalies faster than ML models

B ML requires less computational resources than static threshold alerts

C ML adapts to changing data patterns and detects subtle anomalies without predefined thresholds

D ML models do not need any historical data to detect anomalies

💡 Hint

Think about how ML models learn from data patterns over time.

Machine learning models adapt to evolving data and can detect anomalies that static thresholds miss, making them more flexible and accurate.