[BUG] Sample feature output visualisation is incorrect

[allenphilip93]

Description: The sample feature output visualisation is shown differently from the actual value

Actuals:

Sample Feature Output:

I've taken the sample index and applied the same filters in both the cases. For the feature I've aggregated by count on one of the filtered features.

ES Version: 1.10.1

[kaituo]

The actual graph showed it is per 12 hours. Does it mean you have a count of doc.transactionEvent.store_name.keyword every 12 hours? What intervals do you use for the detector?

[allenphilip93]

Yes, I've configured the anomaly detector interval for 12h with default window size (8 intervals). I'm also using the same field for x-axis (lastModifiedOn) for both the cases.

Just to clarify, the plot for Sample Feature Breakdown is essentially the input time series feature for the detector in the same default timezone right?

[kaituo]

Tried to reproduce your bug without success. It is hard to make the graph look exactly the same as AD dashboard and Kibana Visualization use different start and end timestamps to aggregate data. For example, even though both graphs use 5 minute interval, AD dashboard uses the range between 1650180367561 and 1650180367561 to aggregate data, while Kibana Visualization uses the range between 1650180317561 and 1650180317561 to aggregate data. But the rough trend and shape of the line should match. But from your graphs, we have totally different things.

Also, yes, the plot for Sample Feature Breakdown is essentially the input time series feature for the detector in the same default timezone.

Can you share your data and configuration (including AD and visualization configuration)? We can also get on a call if it is easier. If yes, please leave your email and preferred time slots.

Example 1 (5 min interval):

Example 2 (5 minute interval):

Example 3 (12 hr interval):