Kaituo Li

We have already implemented this feature in ES 7.9+. Please try it out.

sorry for the late reply. A few questions: First, for step 6, what's your detection interval? When stopping detectors, previous models are erased and new training starts. That's why you...

Do you have live data? You can verify it by issuing a query against the source index within [now-your detector interval, now].

Thanks Tej. I will discuss with the team and reply later.

Hi Tej, we accepted the feature request and will put this to our backlog. You are also welcome to contribute the changes if you have bandwidth.

need to create a unit test to prevent future regression: In this specific case, the issue occurs in the toXContent method of AnomalyResult class. The test case is just create...

ref: https://github.com/elastic/elasticsearch/pull/60945 It seems they enforce this through IndexNameExpressionResolver.checkSystemIndexAccess on the rest layer. The fix is to not to directly access them on the rest layer, but on transport layer.

another case: [2020-12-28T15:52:58,752][ERROR][o.e.r.a.RestResponseListener] [integTest-0] failed to send failure response java.lang.IllegalStateException: Channel is already closed at org.elasticsearch.rest.RestController$ResourceHandlingHttpChannel.close(RestController.java:511) ~[elasticsearch-7.9.1.jar:7.9.1] at org.elasticsearch.rest.RestController$ResourceHandlingHttpChannel.sendResponse(RestController.java:504) ~[elasticsearch-7.9.1.jar:7.9.1] at org.elasticsearch.rest.action.RestActionListener.onFailure(RestActionListener.java:58) [elasticsearch-7.9.1.jar:7.9.1] at org.elasticsearch.rest.action.RestActionListener.onResponse(RestActionListener.java:49) [elasticsearch-7.9.1.jar:7.9.1] at org.elasticsearch.action.support.TransportAction$1.onResponse(TransportAction.java:89) [elasticsearch-7.9.1.jar:7.9.1] at...

The actual graph showed it is per 12 hours. Does it mean you have a count of doc.transactionEvent.store_name.keyword every 12 hours? What intervals do you use for the detector?

Tried to reproduce your bug without success. It is hard to make the graph look exactly the same as AD dashboard and Kibana Visualization use different start and end timestamps...