[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-kibana-anomaly-detection":3,"mdc--o4hzf3-key":34,"related-repo-elastic-kibana-anomaly-detection":4603,"related-org-elastic-kibana-anomaly-detection":4700},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"kibana-anomaly-detection","manage Elastic ML anomaly detection jobs","Elastic ML anomaly detection skill — investigation\u002FRCA, score explanation, job operations (create, datafeed, start\u002Fstop, results), and troubleshooting (missing docs, memory limits, datafeed health, lifecycle). Operates against Kibana Agent Builder MCP tools (`ad_*`) on `.ml-anomalies-*`, `.ml-config`, `.ml-notifications-*`, `.ml-annotations-*`. Use when answering \"what broke?\"\u002F\"which entity?\"\u002FRCA, \"why is score high\u002Flow?\"\u002Frenormalization, \"datafeed stopped\"\u002F\"memory limit\", or any request to set up or configure an ML anomaly detection job.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Observability","observability","tag",{"name":17,"slug":18,"type":15},"Machine Learning","machine-learning",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Anomaly Detection","anomaly-detection",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:52.539246",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fkibana\u002Fkibana-anomaly-detection","---\nname: kibana-anomaly-detection\ndescription: Elastic ML anomaly detection skill — investigation\u002FRCA, score explanation,\n job operations (create, datafeed, start\u002Fstop, results), and troubleshooting (missing\n docs, memory limits, datafeed health, lifecycle). Operates against Kibana Agent\n Builder MCP tools (`ad_*`) on `.ml-anomalies-*`, `.ml-config`, `.ml-notifications-*`,\n `.ml-annotations-*`. Use when answering \"what broke?\"\u002F\"which entity?\"\u002FRCA, \"why\n is score high\u002Flow?\"\u002Frenormalization, \"datafeed stopped\"\u002F\"memory limit\", or any request\n to set up or configure an ML anomaly detection job.\nmetadata:\n author: elastic\n version: 0.2.0\ncompatibility: Kibana 8.x–9.x with Agent Builder and Workflows; Elasticsearch 8.x–9.x\n with machine learning\n---\n\n# Elastic ML Anomaly Detection\n\nSingle skill covering all anomaly detection work against **Kibana Agent Builder** MCP at\n`{KIBANA_URL}\u002Fapi\u002Fagent_builder\u002Fmcp`. Use the **Mode Selector** below to pick the right approach for the user's question\n— modes share the same tool surface and concepts.\n\n## Platform\n\n- Read path: ES|QL against `.ml-anomalies-*`, `.ml-config`, `.ml-notifications-*`, `.ml-annotations-*`\n- Always-available: `platform.core.execute_esql` (plus additional platform tools for search, index mapping, and\n documentation — see `scripts\u002Fagent_builder_constants.json`)\n- ML API spec (if available): `.kibana_ai_openapi_spec_elasticsearch` — see\n [references\u002Fanomaly-detection-openapi-spec-discover.md](references\u002Fanomaly-detection-openapi-spec-discover.md) for\n discovery pattern.\n- **Run `ad_validate_ml_tool_permissions` first** when tools return empty\u002Fmisleading results — missing privileges are\n the most common cause of false negatives. Full permissions matrix:\n [references\u002Fpermissions-matrix.md](references\u002Fpermissions-matrix.md).\n\n## Mode Selector\n\n| User intent | Mode |\n| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |\n| \"What broke?\" \u002F RCA \u002F cross-job \u002F blast radius \u002F influencers \u002F log categories | **Investigate** |\n| \"Why score high\u002Flow?\" \u002F renormalization \u002F model bounds \u002F forecasts | **Explain** |\n| Missing docs \u002F memory limit \u002F datafeed stopped \u002F CCS \u002F lifecycle \u002F calendars | **Troubleshoot** |\n| Create a job \u002F configure a datafeed \u002F start analysis \u002F retrieve results | **Manage** |\n| Security framing (attack chains, MITRE, exfil) | Investigate + [references\u002Fsecurity-anomaly-expert.md](references\u002Fsecurity-anomaly-expert.md) |\n| Observability\u002FSRE framing (degradation, capacity, deployment regression) | Investigate + [references\u002Fobservability-anomaly-expert.md](references\u002Fobservability-anomaly-expert.md) |\n\nWhen a question spans modes: **Investigate → Explain → Troubleshoot**. Don't blend mode logic — finish one before moving\non.\n\n---\n\n## Score Quick Reference\n\n- `record_score` bands: **>75** critical · **50–75** warning · **25–50** minor · **\u003C25** informational\n- `multi_bucket_impact ≥ 3` → sustained shift (not a transient spike)\n- `initial_record_score >> record_score` → renormalization (model saw worse anomalies later)\n- `actual \u003C\u003C typical` with `count`\u002F`low_count`\u002F`low_mean` → absence\u002Foutage, not just low value\n- Low scores across many jobs > one high score — composite cross-job signal often beats single-detector severity\n\n> Full score definitions, renormalization mechanics, and `anomaly_score_explanation` components:\n> [references\u002Fscore-reference.md](references\u002Fscore-reference.md).\n\n## Core concepts\n\nTreat `.ml-anomalies-*` as three layers, accessed via `result_type`:\n\n- **`bucket`** — bucket-level unusualness per `bucket_span`. `anomaly_score` is the aggregate across all detectors.\n- **`record`** — finest-grained rows with `actual` vs `typical`, `probability`, `record_score`,\n `anomaly_score_explanation`.\n- **`influencer`** — entity contributions ranked within a bucket (`influencer_score`).\n\nRead scores this way:\n\n- `anomaly_score` \u002F `record_score` = **current normalized** values (move as the model sees new extremes).\n- `initial_anomaly_score` \u002F `initial_record_score` = **immutable snapshots** from detection time.\n- Compare `actual` to `typical`; use `probability` for raw likelihood.\n- Map entities via `partition_field_value` \u002F `by_field_value` \u002F `over_field_value`.\n- Read `multi_bucket_impact` (-5 to +5) to separate single-bucket spikes from sustained trends.\n\n---\n\n## Mode: Investigate — RCA\n\n**When:** \"what broke?\", \"which entity caused this?\", cross-job correlation, blast radius, attack\u002Fcascade chains.\n\n### Tool chain\n\n| Phase | Tools |\n| --------------------- | -------------------------------------------------------------------------------------------------------------- |\n| Discovery | `ad_get_available_metadata`, `ad_get_jobs`, `ad_discover_related_jobs`, `ad_discover_jobs_by_datafeed_index` |\n| Timeline \u002F scope | `ad_query_anomaly_timeline` |\n| Cross-job \u002F entities | `ad_rca_cross_job_entity_match`, `ad_rca_multi_job_entities`, `ad_rca_entity_profile` |\n| Records \u002F influencers | `ad_query_anomaly_records`, `ad_query_influencers` |\n| RCA depth | `ad_rca_detector_fingerprint`, `ad_rca_correlation`, `ad_rca_blast_radius`, `ad_rca_score_reassessment` |\n| Evidence \u002F categories | `ad_get_job_datafeed_config`, `ad_rca_source_evidence`, `ad_get_categories`, `ad_search_log_category_examples` |\n\n### Protocol\n\nFollow the 14-step sequence in [references\u002Fprotocols\u002Finvestigation.md](references\u002Fprotocols\u002Finvestigation.md). High\nlevel: `ad_get_available_metadata` → pair `ad_discover_jobs_by_datafeed_index` with `ad_discover_related_jobs` →\n`ad_query_anomaly_timeline` → rank with `ad_rca_multi_job_entities` (`min_job_count=2`) → `ad_rca_detector_fingerprint`\n→ drill with `ad_query_anomaly_records` + `ad_query_influencers` (low `min_score=25`) → profile with\n`ad_rca_entity_profile` → order with `ad_rca_correlation` → confirm with `ad_rca_source_evidence`. When\n`by_field_name == \"mlcategory\"`, compare with `ad_get_categories` + paired `ad_search_log_category_examples` (baseline\nvs. anomaly window).\n\nFinish with a written RCA: **root cause entity · affected jobs · temporal progression · fault class\n(resource\u002Fnetwork\u002Fapplication) · severity · recommended actions**. Worked example:\n[references\u002Fworked-example.md](references\u002Fworked-example.md). Full ES|QL templates and parameters:\n[references\u002Finvestigate-anomaly-esql-tools.md](references\u002Finvestigate-anomaly-esql-tools.md).\n\n### Rules\n\n1. **Multi-job entities are prime suspects; single-job entities are usually victims.** Use `min_job_count=2`.\n2. **Earliest anomaly timestamp wins** — sort `ad_rca_correlation` by timestamp; first-appearing entity = origin.\n3. **`multi_bucket_impact ≥ 3` = sustained behavioral shift**, weight higher than transient spikes.\n4. **Never close an RCA without `ad_rca_source_evidence`** — raw source documents are ground truth.\n5. **Use low `min_score` (25 or lower) for influencer queries** — high thresholds miss correlated entities.\n\n---\n\n## Mode: Explain — Score \u002F model behavior\n\n**When:** \"why is my score 30\u002F90?\", \"score dropped overnight\", \"what is renormalization?\", \"why wasn't this detected?\".\n\n### Score types\n\n| Field | Scope | Meaning |\n| ---------------------- | --------------- | ----------------------------------------------------------------------- |\n| `record_score` | Single record | Normalized severity after renormalization. |\n| `initial_record_score` | Single record | Score at detection time. Gap vs `record_score` = renormalization drift. |\n| `anomaly_score` | Bucket | Aggregate severity across all detectors in a bucket. |\n| `influencer_score` | Entity × bucket | How anomalous a specific entity is in that bucket. |\n\n### `anomaly_score_explanation` components\n\n| Component | Effect | What it means |\n| -------------------------------- | ------- | ------------------------------------------------------------ |\n| `anomaly_length` | ↑ score | More consecutive anomalous buckets |\n| `single_bucket_impact` | ↑ score | Lower probability → higher impact |\n| `multi_bucket_impact` | ↑ score | Sustained pattern contribution |\n| `anomaly_characteristics_impact` | ↑ score | Mean shift vs. variance change |\n| `high_variance_penalty` | ↓ score | Noisy data → wide bounds → anomaly less surprising |\n| `incomplete_bucket_penalty` | ↓ score | Bucket has less data than expected (ingest lag, sparse data) |\n\n### Why a score looks wrong\n\n- **Unexpectedly low:** `high_variance_penalty`, renormalization, \u003C3 weeks training for weekly seasonality,\n `bucket_span` too large, wrong detector function (`mean` vs `high_mean`), `incomplete_bucket_penalty`, suppression by\n `custom_rules`.\n- **Unexpectedly high:** insufficient history (early training over-flags), high-cardinality split (too few points per\n entity), `use_null: true` on a sparse field.\n\n### Tool chain\n\n| Purpose | Tools |\n| ---------------------- | ---------------------------------------------------------------------------------- |\n| Records + explanation | `ad_query_anomaly_records` (exact `job_id_pattern`) |\n| Renormalization drift | `ad_rca_score_reassessment` (`score_drift = initial_record_score - record_score`) |\n| Model bounds (visual) | `ad_get_model_plot` — actual outside `model_lower`\u002F`model_upper` = anomaly |\n| Forecast overlap | `ad_get_forecast_results` |\n| Influencer attribution | `ad_query_influencers` |\n| Config & detector | `ad_get_job_datafeed_config` — `bucket_span`, function, `custom_rules`, `use_null` |\n| Categorization | `ad_get_categories` |\n| Model snapshots | `ad_get_model_snapshots` |\n| Structured diagnostic | **`ad_wf_troubleshoot_anomaly_score`** (full decision tree) |\n\n### Decision tree (`ad_wf_troubleshoot_anomaly_score`)\n\n1. `ad_get_jobs` — ≥3 weeks data for weekly seasonality?\n2. `ad_ts_model_memory_health` — `memory_status` healthy?\n3. `ad_ts_delayed_data_annotations` — no incomplete buckets?\n4. `ad_query_anomaly_records` — compare `record_score` vs `initial_record_score`.\n5. `ad_get_job_datafeed_config` — `bucket_span`, detector function, `custom_rules`, `use_null`.\n6. `ad_get_model_plot` — wide bounds → `high_variance_penalty`.\n7. `ad_rca_score_reassessment` — renormalization drift across history.\n8. Explain `anomaly_score_explanation` factors.\n\n### Rules\n\n1. **Always show both `initial_record_score` and `record_score`** — the gap is the renormalization story.\n2. **Explain renormalization before diagnosing config** — score drift is the most common \"score dropped\" cause and needs\n no config change.\n3. **`actual \u003C\u003C typical` with `count`\u002F`low_count` is an absence anomaly** — distinguish outages from value spikes.\n4. **`high_variance_penalty` and `incomplete_bucket_penalty` explain most \"low score\" surprises** without remediation.\n5. **Weekly seasonality needs ≥3 weeks of training data** — flag young jobs as the cause.\n\nFor detector function selection details, see\n[references\u002Fanomaly-detection-functions.md](references\u002Fanomaly-detection-functions.md).\n\n---\n\n## Mode: Troubleshoot — Job ops\n\n**When:** \"missing documents\", \"datafeed stopped\", \"hard_limit\", \"results look wrong\", lifecycle changes, calendars,\nCCS.\n\n### Common issues → fast paths\n\n| Issue | Fast path | Full decision tree |\n| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |\n| Missing docs \u002F `query_delay` warning | `ad_ts_delayed_data_annotations` → `ad_ts_bucket_event_gaps` → `ad_ts_ingest_latency_estimate` → `ad_update_datafeed_query_delay` | `ad_wf_troubleshoot_query_delay` |\n| Memory `soft_limit` \u002F `hard_limit` | `ad_ts_model_memory_health` → `ad_wf_ts_field_cardinality` → `ad_estimate_memory_requirement` → `ad_update_model_memory_limit` | `ad_wf_troubleshoot_memory_limit` |\n| Datafeed not running \u002F job state | `ad_get_jobs` (state) → `ad_get_job_messages` → `ad_manage_datafeed` | — |\n| CCS \u002F `remote_cluster:` indices | `ad_ts_ccs_diagnostics` | — |\n| Score sanity check | — | `ad_wf_troubleshoot_anomaly_score` |\n\n> `hard_limit` corrupts model state and causes downstream missing-doc false alarms (categorizer silently skips events\n> for unknown categories). **Fix memory before fixing `query_delay`.**\n\n### Memory concepts\n\n| Field | Meaning |\n| ----------------------------------- | ------------------------------------------------------- |\n| `model_bytes` | Current memory used |\n| `peak_model_bytes` | High-water mark since job opened |\n| `model_bytes_memory_limit` | Configured `model_memory_limit` |\n| `memory_status` | `ok` \u002F `soft_limit` (pruning) \u002F `hard_limit` (critical) |\n| `total_by_field_count > 100k` | `by_field` cardinality too high — dominant driver |\n| `total_partition_field_count > 10k` | Partition explosion |\n| `total_category_count > 10k` | Too many distinct log patterns |\n\nPrefer **`ad_estimate_memory_requirement`** (samples cardinality from source, calls Estimate Model Memory API) over\nheuristics like `peak_model_bytes * 1.3` — the heuristic ignores pure influencer and categorization memory.\n\n### Datafeed & timing concepts\n\n- **`query_delay`** — how far behind real time the datafeed queries. Too small → missing docs; too large → slower\n alerts. Set to **P95 ingest latency + buffer** (default `60s`–`120s`).\n- **`delayed_data_check_config`** — how aggressively the datafeed checks for late data.\n- **`bucket_span`** — analysis interval. Align with data granularity and detection window.\n- **`frequency`** — defaults to `min(query_delay, bucket_span \u002F 2)`.\n\n### Lifecycle for config changes (memory limit, query_delay)\n\n1. Stop datafeed: `ad_manage_datafeed` (`action=_stop`)\n2. Close job\n3. Update config: `ad_update_model_memory_limit`, `ad_update_datafeed_query_delay`,\n `ad_update_delayed_data_check_config`\n4. Open job: `ad_open_job`\n5. Start datafeed: `ad_manage_datafeed` (`action=_start`)\n\nRecover a corrupted period without resetting the whole model: `ad_revert_model_snapshot`.\n\n### Tool surface\n\n| Category | Tools |\n| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Permissions \u002F metadata | `ad_validate_ml_tool_permissions`, `ad_get_available_metadata`, `ad_get_jobs` |\n| Job + datafeed state | `ad_get_job_datafeed_config`, `ad_get_job_messages`, `ad_manage_datafeed`, `ad_preview_datafeed_with_latency` |\n| Timing \u002F missing docs | `ad_ts_delayed_data_annotations`, `ad_ts_bucket_event_gaps`, `ad_ts_ingest_latency_estimate`, `ad_update_datafeed_query_delay`, `ad_update_delayed_data_check_config`, `ad_wf_troubleshoot_query_delay` |\n| Memory | `ad_ts_model_memory_health`, `ad_wf_ts_field_cardinality`, `ad_estimate_memory_requirement`, `ad_update_model_memory_limit`, `ad_wf_troubleshoot_memory_limit` |\n| Model \u002F lifecycle | `ad_get_model_snapshots`, `ad_revert_model_snapshot`, `ad_open_job`, `ad_create_job` |\n| CCS | `ad_ts_ccs_diagnostics` |\n| Calendars | `ad_get_calendar_events`, `ad_create_calendar_event` |\n\nFull parameter tables, ES|QL templates, and REST step lists:\n[references\u002Ftroubleshoot-anomaly-tool-reference.md](references\u002Ftroubleshoot-anomaly-tool-reference.md).\n\n### Rules\n\n1. **`ad_validate_ml_tool_permissions` first** — missing privileges produce misleading empty results.\n2. **Fix memory before `query_delay`** — `hard_limit` corrupts state; `query_delay` fixes on a memory-limited job are\n wasted.\n3. **Stop the datafeed before updating it.** Updating a running datafeed is rejected.\n4. **Close the job before updating memory limit.** Sequence above.\n5. **Prefer workflow tools (`ad_wf_*`) over manually chaining diagnostics** for complex decisions.\n6. **`ad_preview_datafeed_with_latency` before starting** — confirm the datafeed returns data after config changes.\n\n---\n\n## Mode: Manage — Create \u002F configure jobs\n\n**When:** \"set up a job\", \"create an ML detector\", \"monitor X over time\", \"detect rare\u002Funusual\u002Fanomalous values\".\n\n### 4-step workflow\n\n```text\nPUT _ml\u002Fanomaly_detectors\u002F\u003Cjob_id> # 1. Define job (ad_create_job)\nPUT _ml\u002Fdatafeeds\u002Fdatafeed-\u003Cjob_id> # 2. Define datafeed (ad_create_datafeed)\nPOST _ml\u002Fanomaly_detectors\u002F\u003Cjob_id>\u002F_open # 3a. Open job (ad_open_job)\nPOST _ml\u002Fdatafeeds\u002Fdatafeed-\u003Cjob_id>\u002F_start # 3b. Start datafeed (ad_manage_datafeed action=_start)\nGET _ml\u002Fanomaly_detectors\u002F\u003Cjob_id>\u002Fresults\u002Frecords # 4. Read results\n```\n\n### Process\n\n1. **Build configs.** Parse the user request into job + datafeed JSON with no null fields.\n2. **Apply smart defaults:**\n\n | Field | Default | Override when |\n | ---------------- | --------------------------------------- | ------------------------------------------------- |\n | `bucket_span` | `\"15m\"` | User specifies a different span |\n | `time_field` | `\"@timestamp\"` | User names a different timestamp field |\n | `index` | `\"logs-*\"` | User specifies an index or pattern |\n | `datafeed_query` | `{\"match_all\": {}}` | User mentions filters, processes, or time windows |\n | `influencers` | by\u002Fover\u002Fpartition fields from detectors | User adds extra influencer fields |\n | `job_id` | Generated from user description | User provides an explicit ID |\n | `query_delay` | `\"60s\"` | P95 ingest latency is higher |\n\n3. **Choose detector function** from user intent — full table in\n [references\u002Fanomaly-detection-functions.md](references\u002Fanomaly-detection-functions.md):\n - \"high CPU\" \u002F \"unusually large\" → `high_mean` or `high_sum`\n - \"rare logins\" \u002F \"unusual values\" → `rare` (variants below)\n - \"too many requests\" \u002F \"spike in count\" → `high_count`\n\n `rare` variants:\n - Infrequent globally → `rare by_field_name: X`\n - Infrequent vs peers → `rare by_field_name: X over_field_name: Y`\n - Infrequent per segment → `rare by_field_name: X partition_field_name: Y`\n - Infrequent per segment vs peers → `rare by_field_name: X over_field_name: Y partition_field_name: Z`\n\n4. **Validate.** `platform.core.get_index_mapping` on the target index to verify field existence\u002Ftypes →\n `ad_validate_job_spec`. If errors, fix and re-validate (max 3 attempts).\n\n5. **Present and confirm.** Show the **complete** job + datafeed bodies formatted as the exact API calls. Ask for\n approval **once**. If feedback, incorporate and re-present (up to 3 rounds).\n\n6. **Deploy.** After confirmation: `ad_create_job` → `ad_create_datafeed` → `ad_open_job` → `ad_manage_datafeed`\n (`action=_start`). Report final `job_id` and `datafeed_id`.\n\nFor **batch analysis on historical data**, pass `start` and `end` to the datafeed start call.\n\n> Worked examples (rare-username, DNS exfil, large-downloads) with full JSON bodies and datafeed filters:\n> [references\u002Fjob-creation-recipes.md](references\u002Fjob-creation-recipes.md).\n\n### Rules\n\n1. **Create job before datafeed.** Datafeed references job by ID.\n2. **Open job before starting datafeed.** Start on a closed job is rejected.\n3. **`query_delay` = P95 ingest latency + buffer** (60s–120s safe default).\n4. **Forecasts require non-population jobs** — `over_field_name` jobs cannot be forecasted; warn before attempting.\n5. **`by_field_name` vs `over_field_name`:** `by` compares entity to its own history; `over` compares to peer group in\n the same bucket. `partition_field_name` = fully independent sub-model with its own normalization.\n6. **`bucket_span` matches detection granularity** — 15m for high-frequency, 1h for operational metrics, 1d for daily\n patterns. Larger smooths short spikes; smaller increases noise.\n\n---\n\n## Registration (Kibana Agent Builder)\n\nRequires Node.js 18+. Defaults to `elastic`\u002F`changeme` when no credentials are supplied.\n\n```bash\ncd skills\u002Fkibana\u002Fkibana-anomaly-detection\n\n# tools → workflows → skills\nnode scripts\u002Fkibana-agent-builder.mjs all register --kibana-url http:\u002F\u002Flocalhost:5601\n\n# HTTPS with self-signed cert\nnode scripts\u002Fkibana-agent-builder.mjs all register --kibana-url https:\u002F\u002Flocalhost:5601 --insecure\n```\n\n`all register` runs `tools register`, then `workflows register`, then `skills register`. Kibana allows **at most five**\n`tool_ids` per skill; the script fills them by scanning `SKILL.md` for tool mentions (in document order), then appends\nids from `references\u002Fkibana\u002Ftools\u002Fesql\u002F*.json` until the cap (workflow-only tools omitted by default). If you run\n`skills register` alone, run `tools register` first so those ids exist.\n\nWorkflow tool exclusions and prefixes live in `scripts\u002Fagent_builder_constants.json`.\n\n**MCP API key permissions:**\n\n- Kibana: `read_onechat`, `space_read`\n- Index: `read`, `view_index_metadata` on `.ml-anomalies-*`, `.ml-annotations-*`, `.ml-notifications-*`, `.ml-config`\n- For source evidence: `read` on source data indices\n\n---\n\n## Tool inventory\n\nES|QL tool specs live under `references\u002Fkibana\u002Ftools\u002Fesql\u002F*.json`; workflow definitions under\n`references\u002Fkibana\u002Fworkflows\u002F*.yaml`. Each Mode section above lists the tools it uses. Full surface:\n[references\u002Ftools.md](references\u002Ftools.md) (ES|QL) and [references\u002Fworkflow-tools.md](references\u002Fworkflow-tools.md)\n(workflows).\n\n### Key system indices\n\n| Index | Relevant content |\n| --------------------- | ----------------------------------------------------------------------------------------------------------------------------- |\n| `.ml-anomalies-*` | `record`, `bucket`, `influencer`, `model_plot`, `model_forecast`, `model_snapshot`, `category_definition`, `model_size_stats` |\n| `.ml-config` | job\u002Fdatafeed documents (visible even for never-run jobs) |\n| `.ml-annotations-*` | delayed data (`event == \"delayed_data\"`) |\n| `.ml-notifications-*` | job messages (`level`: info\u002Fwarning\u002Ferror) |\n\n---\n\n## Examples\n\n**RCA:** \"Something caused a spike in our error rate at 2pm — what broke?\" → Investigate → `ad_get_available_metadata` →\n`ad_query_anomaly_timeline` → `ad_rca_cross_job_entity_match` → `ad_rca_multi_job_entities` → RCA report.\n\n**Score drop:** \"My anomaly score went from 90 to 55 — did the model change?\" → Explain → `ad_rca_score_reassessment`\nfor drift → explain renormalization if `score_drift` is large.\n\n**Memory limit:** \"Job status shows `hard_limit` and results look wrong.\" → Troubleshoot → `ad_ts_model_memory_health` →\n`ad_wf_ts_field_cardinality` → `ad_estimate_memory_requirement` → `ad_update_model_memory_limit` (lifecycle: stop\ndatafeed → close → update → open → start).\n\n**New job:** \"Detect unusual error rates per host on nginx access logs.\" → Manage → `high_count` detector with\n`by_field_name: \"host.keyword\"` → validate → present → deploy.\n\n**Multi-mode:** \"We had an incident last night, scores were high but now low — is the job healthy?\" → Investigate the\nincident → Explain the score drift → Troubleshoot if `hard_limit` or delayed data is suspected.\n\n---\n\n## Guidelines\n\n1. **Pick a mode first.** Don't blend RCA logic with score-explanation logic in one response.\n2. **`ad_validate_ml_tool_permissions` first** on empty results — privileges are the most common false-negative cause.\n3. **Score bands are absolute thresholds**: `>75` critical, `50–75` warning, `25–50` minor, `\u003C25` informational.\n4. **Multi-job entities are prime suspects.** Use `min_job_count=2` in `ad_rca_multi_job_entities`.\n5. **Show `initial_record_score` alongside `record_score`** — the gap tells the renormalization story.\n6. **Fix memory before `query_delay`.** `hard_limit` invalidates downstream diagnostics.\n7. **Stop datafeed → close job → update config → open job → start datafeed** for any config change to memory or query\n delay.\n8. **Confirm RCAs with `ad_rca_source_evidence`.** Raw source documents are ground truth.\n",{"data":35,"body":39},{"name":4,"description":6,"metadata":36,"compatibility":38},{"author":8,"version":37},"0.2.0","Kibana 8.x–9.x with Agent Builder and Workflows; Elasticsearch 8.x–9.x with machine learning",{"type":40,"children":41},"root",[42,51,81,88,193,198,325,337,341,347,450,473,479,499,603,608,724,727,733,743,750,958,964,1090,1115,1121,1206,1209,1215,1224,1230,1347,1358,1512,1518,1592,1597,1826,1838,1968,1973,2066,2077,2080,2086,2095,2101,2327,2351,2357,2526,2549,2555,2641,2647,2725,2737,2743,2988,2999,3004,3102,3105,3111,3120,3126,3138,3144,3586,3613,3627,3632,3746,3749,3755,3774,3907,3984,3995,4003,4079,4082,4088,4122,4128,4279,4282,4288,4323,4348,4390,4415,4432,4435,4441,4597],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"elastic-ml-anomaly-detection",[48],{"type":49,"value":50},"text","Elastic ML Anomaly Detection",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55,57,63,65,72,74,79],{"type":49,"value":56},"Single skill covering all anomaly detection work against ",{"type":43,"tag":58,"props":59,"children":60},"strong",{},[61],{"type":49,"value":62},"Kibana Agent Builder",{"type":49,"value":64}," MCP at\n",{"type":43,"tag":66,"props":67,"children":69},"code",{"className":68},[],[70],{"type":49,"value":71},"{KIBANA_URL}\u002Fapi\u002Fagent_builder\u002Fmcp",{"type":49,"value":73},". Use the ",{"type":43,"tag":58,"props":75,"children":76},{},[77],{"type":49,"value":78},"Mode Selector",{"type":49,"value":80}," below to pick the right approach for the user's question\n— modes share the same tool surface and concepts.",{"type":43,"tag":82,"props":83,"children":85},"h2",{"id":84},"platform",[86],{"type":49,"value":87},"Platform",{"type":43,"tag":89,"props":90,"children":91},"ul",{},[92,126,147,168],{"type":43,"tag":93,"props":94,"children":95},"li",{},[96,98,104,106,112,113,119,120],{"type":49,"value":97},"Read path: ES|QL against ",{"type":43,"tag":66,"props":99,"children":101},{"className":100},[],[102],{"type":49,"value":103},".ml-anomalies-*",{"type":49,"value":105},", ",{"type":43,"tag":66,"props":107,"children":109},{"className":108},[],[110],{"type":49,"value":111},".ml-config",{"type":49,"value":105},{"type":43,"tag":66,"props":114,"children":116},{"className":115},[],[117],{"type":49,"value":118},".ml-notifications-*",{"type":49,"value":105},{"type":43,"tag":66,"props":121,"children":123},{"className":122},[],[124],{"type":49,"value":125},".ml-annotations-*",{"type":43,"tag":93,"props":127,"children":128},{},[129,131,137,139,145],{"type":49,"value":130},"Always-available: ",{"type":43,"tag":66,"props":132,"children":134},{"className":133},[],[135],{"type":49,"value":136},"platform.core.execute_esql",{"type":49,"value":138}," (plus additional platform tools for search, index mapping, and\ndocumentation — see ",{"type":43,"tag":66,"props":140,"children":142},{"className":141},[],[143],{"type":49,"value":144},"scripts\u002Fagent_builder_constants.json",{"type":49,"value":146},")",{"type":43,"tag":93,"props":148,"children":149},{},[150,152,158,160,166],{"type":49,"value":151},"ML API spec (if available): ",{"type":43,"tag":66,"props":153,"children":155},{"className":154},[],[156],{"type":49,"value":157},".kibana_ai_openapi_spec_elasticsearch",{"type":49,"value":159}," — see\n",{"type":43,"tag":161,"props":162,"children":164},"a",{"href":163},"references\u002Fanomaly-detection-openapi-spec-discover.md",[165],{"type":49,"value":163},{"type":49,"value":167}," for\ndiscovery pattern.",{"type":43,"tag":93,"props":169,"children":170},{},[171,184,186,191],{"type":43,"tag":58,"props":172,"children":173},{},[174,176,182],{"type":49,"value":175},"Run ",{"type":43,"tag":66,"props":177,"children":179},{"className":178},[],[180],{"type":49,"value":181},"ad_validate_ml_tool_permissions",{"type":49,"value":183}," first",{"type":49,"value":185}," when tools return empty\u002Fmisleading results — missing privileges are\nthe most common cause of false negatives. Full permissions matrix:\n",{"type":43,"tag":161,"props":187,"children":189},{"href":188},"references\u002Fpermissions-matrix.md",[190],{"type":49,"value":188},{"type":49,"value":192},".",{"type":43,"tag":82,"props":194,"children":196},{"id":195},"mode-selector",[197],{"type":49,"value":78},{"type":43,"tag":199,"props":200,"children":201},"table",{},[202,221],{"type":43,"tag":203,"props":204,"children":205},"thead",{},[206],{"type":43,"tag":207,"props":208,"children":209},"tr",{},[210,216],{"type":43,"tag":211,"props":212,"children":213},"th",{},[214],{"type":49,"value":215},"User intent",{"type":43,"tag":211,"props":217,"children":218},{},[219],{"type":49,"value":220},"Mode",{"type":43,"tag":222,"props":223,"children":224},"tbody",{},[225,242,258,274,290,308],{"type":43,"tag":207,"props":226,"children":227},{},[228,234],{"type":43,"tag":229,"props":230,"children":231},"td",{},[232],{"type":49,"value":233},"\"What broke?\" \u002F RCA \u002F cross-job \u002F blast radius \u002F influencers \u002F log categories",{"type":43,"tag":229,"props":235,"children":236},{},[237],{"type":43,"tag":58,"props":238,"children":239},{},[240],{"type":49,"value":241},"Investigate",{"type":43,"tag":207,"props":243,"children":244},{},[245,250],{"type":43,"tag":229,"props":246,"children":247},{},[248],{"type":49,"value":249},"\"Why score high\u002Flow?\" \u002F renormalization \u002F model bounds \u002F forecasts",{"type":43,"tag":229,"props":251,"children":252},{},[253],{"type":43,"tag":58,"props":254,"children":255},{},[256],{"type":49,"value":257},"Explain",{"type":43,"tag":207,"props":259,"children":260},{},[261,266],{"type":43,"tag":229,"props":262,"children":263},{},[264],{"type":49,"value":265},"Missing docs \u002F memory limit \u002F datafeed stopped \u002F CCS \u002F lifecycle \u002F calendars",{"type":43,"tag":229,"props":267,"children":268},{},[269],{"type":43,"tag":58,"props":270,"children":271},{},[272],{"type":49,"value":273},"Troubleshoot",{"type":43,"tag":207,"props":275,"children":276},{},[277,282],{"type":43,"tag":229,"props":278,"children":279},{},[280],{"type":49,"value":281},"Create a job \u002F configure a datafeed \u002F start analysis \u002F retrieve results",{"type":43,"tag":229,"props":283,"children":284},{},[285],{"type":43,"tag":58,"props":286,"children":287},{},[288],{"type":49,"value":289},"Manage",{"type":43,"tag":207,"props":291,"children":292},{},[293,298],{"type":43,"tag":229,"props":294,"children":295},{},[296],{"type":49,"value":297},"Security framing (attack chains, MITRE, exfil)",{"type":43,"tag":229,"props":299,"children":300},{},[301,303],{"type":49,"value":302},"Investigate + ",{"type":43,"tag":161,"props":304,"children":306},{"href":305},"references\u002Fsecurity-anomaly-expert.md",[307],{"type":49,"value":305},{"type":43,"tag":207,"props":309,"children":310},{},[311,316],{"type":43,"tag":229,"props":312,"children":313},{},[314],{"type":49,"value":315},"Observability\u002FSRE framing (degradation, capacity, deployment regression)",{"type":43,"tag":229,"props":317,"children":318},{},[319,320],{"type":49,"value":302},{"type":43,"tag":161,"props":321,"children":323},{"href":322},"references\u002Fobservability-anomaly-expert.md",[324],{"type":49,"value":322},{"type":43,"tag":52,"props":326,"children":327},{},[328,330,335],{"type":49,"value":329},"When a question spans modes: ",{"type":43,"tag":58,"props":331,"children":332},{},[333],{"type":49,"value":334},"Investigate → Explain → Troubleshoot",{"type":49,"value":336},". Don't blend mode logic — finish one before moving\non.",{"type":43,"tag":338,"props":339,"children":340},"hr",{},[],{"type":43,"tag":82,"props":342,"children":344},{"id":343},"score-quick-reference",[345],{"type":49,"value":346},"Score Quick Reference",{"type":43,"tag":89,"props":348,"children":349},{},[350,389,400,411,445],{"type":43,"tag":93,"props":351,"children":352},{},[353,359,361,366,368,373,375,380,382,387],{"type":43,"tag":66,"props":354,"children":356},{"className":355},[],[357],{"type":49,"value":358},"record_score",{"type":49,"value":360}," bands: ",{"type":43,"tag":58,"props":362,"children":363},{},[364],{"type":49,"value":365},">75",{"type":49,"value":367}," critical · ",{"type":43,"tag":58,"props":369,"children":370},{},[371],{"type":49,"value":372},"50–75",{"type":49,"value":374}," warning · ",{"type":43,"tag":58,"props":376,"children":377},{},[378],{"type":49,"value":379},"25–50",{"type":49,"value":381}," minor · ",{"type":43,"tag":58,"props":383,"children":384},{},[385],{"type":49,"value":386},"\u003C25",{"type":49,"value":388}," informational",{"type":43,"tag":93,"props":390,"children":391},{},[392,398],{"type":43,"tag":66,"props":393,"children":395},{"className":394},[],[396],{"type":49,"value":397},"multi_bucket_impact ≥ 3",{"type":49,"value":399}," → sustained shift (not a transient spike)",{"type":43,"tag":93,"props":401,"children":402},{},[403,409],{"type":43,"tag":66,"props":404,"children":406},{"className":405},[],[407],{"type":49,"value":408},"initial_record_score >> record_score",{"type":49,"value":410}," → renormalization (model saw worse anomalies later)",{"type":43,"tag":93,"props":412,"children":413},{},[414,420,422,428,430,436,437,443],{"type":43,"tag":66,"props":415,"children":417},{"className":416},[],[418],{"type":49,"value":419},"actual \u003C\u003C typical",{"type":49,"value":421}," with ",{"type":43,"tag":66,"props":423,"children":425},{"className":424},[],[426],{"type":49,"value":427},"count",{"type":49,"value":429},"\u002F",{"type":43,"tag":66,"props":431,"children":433},{"className":432},[],[434],{"type":49,"value":435},"low_count",{"type":49,"value":429},{"type":43,"tag":66,"props":438,"children":440},{"className":439},[],[441],{"type":49,"value":442},"low_mean",{"type":49,"value":444}," → absence\u002Foutage, not just low value",{"type":43,"tag":93,"props":446,"children":447},{},[448],{"type":49,"value":449},"Low scores across many jobs > one high score — composite cross-job signal often beats single-detector severity",{"type":43,"tag":451,"props":452,"children":453},"blockquote",{},[454],{"type":43,"tag":52,"props":455,"children":456},{},[457,459,465,467,472],{"type":49,"value":458},"Full score definitions, renormalization mechanics, and ",{"type":43,"tag":66,"props":460,"children":462},{"className":461},[],[463],{"type":49,"value":464},"anomaly_score_explanation",{"type":49,"value":466}," components:\n",{"type":43,"tag":161,"props":468,"children":470},{"href":469},"references\u002Fscore-reference.md",[471],{"type":49,"value":469},{"type":49,"value":192},{"type":43,"tag":82,"props":474,"children":476},{"id":475},"core-concepts",[477],{"type":49,"value":478},"Core concepts",{"type":43,"tag":52,"props":480,"children":481},{},[482,484,489,491,497],{"type":49,"value":483},"Treat ",{"type":43,"tag":66,"props":485,"children":487},{"className":486},[],[488],{"type":49,"value":103},{"type":49,"value":490}," as three layers, accessed via ",{"type":43,"tag":66,"props":492,"children":494},{"className":493},[],[495],{"type":49,"value":496},"result_type",{"type":49,"value":498},":",{"type":43,"tag":89,"props":500,"children":501},{},[502,532,581],{"type":43,"tag":93,"props":503,"children":504},{},[505,514,516,522,524,530],{"type":43,"tag":58,"props":506,"children":507},{},[508],{"type":43,"tag":66,"props":509,"children":511},{"className":510},[],[512],{"type":49,"value":513},"bucket",{"type":49,"value":515}," — bucket-level unusualness per ",{"type":43,"tag":66,"props":517,"children":519},{"className":518},[],[520],{"type":49,"value":521},"bucket_span",{"type":49,"value":523},". ",{"type":43,"tag":66,"props":525,"children":527},{"className":526},[],[528],{"type":49,"value":529},"anomaly_score",{"type":49,"value":531}," is the aggregate across all detectors.",{"type":43,"tag":93,"props":533,"children":534},{},[535,544,546,552,554,560,561,567,568,573,575,580],{"type":43,"tag":58,"props":536,"children":537},{},[538],{"type":43,"tag":66,"props":539,"children":541},{"className":540},[],[542],{"type":49,"value":543},"record",{"type":49,"value":545}," — finest-grained rows with ",{"type":43,"tag":66,"props":547,"children":549},{"className":548},[],[550],{"type":49,"value":551},"actual",{"type":49,"value":553}," vs ",{"type":43,"tag":66,"props":555,"children":557},{"className":556},[],[558],{"type":49,"value":559},"typical",{"type":49,"value":105},{"type":43,"tag":66,"props":562,"children":564},{"className":563},[],[565],{"type":49,"value":566},"probability",{"type":49,"value":105},{"type":43,"tag":66,"props":569,"children":571},{"className":570},[],[572],{"type":49,"value":358},{"type":49,"value":574},",\n",{"type":43,"tag":66,"props":576,"children":578},{"className":577},[],[579],{"type":49,"value":464},{"type":49,"value":192},{"type":43,"tag":93,"props":582,"children":583},{},[584,593,595,601],{"type":43,"tag":58,"props":585,"children":586},{},[587],{"type":43,"tag":66,"props":588,"children":590},{"className":589},[],[591],{"type":49,"value":592},"influencer",{"type":49,"value":594}," — entity contributions ranked within a bucket (",{"type":43,"tag":66,"props":596,"children":598},{"className":597},[],[599],{"type":49,"value":600},"influencer_score",{"type":49,"value":602},").",{"type":43,"tag":52,"props":604,"children":605},{},[606],{"type":49,"value":607},"Read scores this way:",{"type":43,"tag":89,"props":609,"children":610},{},[611,635,659,685,711],{"type":43,"tag":93,"props":612,"children":613},{},[614,619,621,626,628,633],{"type":43,"tag":66,"props":615,"children":617},{"className":616},[],[618],{"type":49,"value":529},{"type":49,"value":620}," \u002F ",{"type":43,"tag":66,"props":622,"children":624},{"className":623},[],[625],{"type":49,"value":358},{"type":49,"value":627}," = ",{"type":43,"tag":58,"props":629,"children":630},{},[631],{"type":49,"value":632},"current normalized",{"type":49,"value":634}," values (move as the model sees new extremes).",{"type":43,"tag":93,"props":636,"children":637},{},[638,644,645,651,652,657],{"type":43,"tag":66,"props":639,"children":641},{"className":640},[],[642],{"type":49,"value":643},"initial_anomaly_score",{"type":49,"value":620},{"type":43,"tag":66,"props":646,"children":648},{"className":647},[],[649],{"type":49,"value":650},"initial_record_score",{"type":49,"value":627},{"type":43,"tag":58,"props":653,"children":654},{},[655],{"type":49,"value":656},"immutable snapshots",{"type":49,"value":658}," from detection time.",{"type":43,"tag":93,"props":660,"children":661},{},[662,664,669,671,676,678,683],{"type":49,"value":663},"Compare ",{"type":43,"tag":66,"props":665,"children":667},{"className":666},[],[668],{"type":49,"value":551},{"type":49,"value":670}," to ",{"type":43,"tag":66,"props":672,"children":674},{"className":673},[],[675],{"type":49,"value":559},{"type":49,"value":677},"; use ",{"type":43,"tag":66,"props":679,"children":681},{"className":680},[],[682],{"type":49,"value":566},{"type":49,"value":684}," for raw likelihood.",{"type":43,"tag":93,"props":686,"children":687},{},[688,690,696,697,703,704,710],{"type":49,"value":689},"Map entities via ",{"type":43,"tag":66,"props":691,"children":693},{"className":692},[],[694],{"type":49,"value":695},"partition_field_value",{"type":49,"value":620},{"type":43,"tag":66,"props":698,"children":700},{"className":699},[],[701],{"type":49,"value":702},"by_field_value",{"type":49,"value":620},{"type":43,"tag":66,"props":705,"children":707},{"className":706},[],[708],{"type":49,"value":709},"over_field_value",{"type":49,"value":192},{"type":43,"tag":93,"props":712,"children":713},{},[714,716,722],{"type":49,"value":715},"Read ",{"type":43,"tag":66,"props":717,"children":719},{"className":718},[],[720],{"type":49,"value":721},"multi_bucket_impact",{"type":49,"value":723}," (-5 to +5) to separate single-bucket spikes from sustained trends.",{"type":43,"tag":338,"props":725,"children":726},{},[],{"type":43,"tag":82,"props":728,"children":730},{"id":729},"mode-investigate-rca",[731],{"type":49,"value":732},"Mode: Investigate — RCA",{"type":43,"tag":52,"props":734,"children":735},{},[736,741],{"type":43,"tag":58,"props":737,"children":738},{},[739],{"type":49,"value":740},"When:",{"type":49,"value":742}," \"what broke?\", \"which entity caused this?\", cross-job correlation, blast radius, attack\u002Fcascade chains.",{"type":43,"tag":744,"props":745,"children":747},"h3",{"id":746},"tool-chain",[748],{"type":49,"value":749},"Tool chain",{"type":43,"tag":199,"props":751,"children":752},{},[753,769],{"type":43,"tag":203,"props":754,"children":755},{},[756],{"type":43,"tag":207,"props":757,"children":758},{},[759,764],{"type":43,"tag":211,"props":760,"children":761},{},[762],{"type":49,"value":763},"Phase",{"type":43,"tag":211,"props":765,"children":766},{},[767],{"type":49,"value":768},"Tools",{"type":43,"tag":222,"props":770,"children":771},{},[772,810,827,858,882,920],{"type":43,"tag":207,"props":773,"children":774},{},[775,780],{"type":43,"tag":229,"props":776,"children":777},{},[778],{"type":49,"value":779},"Discovery",{"type":43,"tag":229,"props":781,"children":782},{},[783,789,790,796,797,803,804],{"type":43,"tag":66,"props":784,"children":786},{"className":785},[],[787],{"type":49,"value":788},"ad_get_available_metadata",{"type":49,"value":105},{"type":43,"tag":66,"props":791,"children":793},{"className":792},[],[794],{"type":49,"value":795},"ad_get_jobs",{"type":49,"value":105},{"type":43,"tag":66,"props":798,"children":800},{"className":799},[],[801],{"type":49,"value":802},"ad_discover_related_jobs",{"type":49,"value":105},{"type":43,"tag":66,"props":805,"children":807},{"className":806},[],[808],{"type":49,"value":809},"ad_discover_jobs_by_datafeed_index",{"type":43,"tag":207,"props":811,"children":812},{},[813,818],{"type":43,"tag":229,"props":814,"children":815},{},[816],{"type":49,"value":817},"Timeline \u002F scope",{"type":43,"tag":229,"props":819,"children":820},{},[821],{"type":43,"tag":66,"props":822,"children":824},{"className":823},[],[825],{"type":49,"value":826},"ad_query_anomaly_timeline",{"type":43,"tag":207,"props":828,"children":829},{},[830,835],{"type":43,"tag":229,"props":831,"children":832},{},[833],{"type":49,"value":834},"Cross-job \u002F entities",{"type":43,"tag":229,"props":836,"children":837},{},[838,844,845,851,852],{"type":43,"tag":66,"props":839,"children":841},{"className":840},[],[842],{"type":49,"value":843},"ad_rca_cross_job_entity_match",{"type":49,"value":105},{"type":43,"tag":66,"props":846,"children":848},{"className":847},[],[849],{"type":49,"value":850},"ad_rca_multi_job_entities",{"type":49,"value":105},{"type":43,"tag":66,"props":853,"children":855},{"className":854},[],[856],{"type":49,"value":857},"ad_rca_entity_profile",{"type":43,"tag":207,"props":859,"children":860},{},[861,866],{"type":43,"tag":229,"props":862,"children":863},{},[864],{"type":49,"value":865},"Records \u002F influencers",{"type":43,"tag":229,"props":867,"children":868},{},[869,875,876],{"type":43,"tag":66,"props":870,"children":872},{"className":871},[],[873],{"type":49,"value":874},"ad_query_anomaly_records",{"type":49,"value":105},{"type":43,"tag":66,"props":877,"children":879},{"className":878},[],[880],{"type":49,"value":881},"ad_query_influencers",{"type":43,"tag":207,"props":883,"children":884},{},[885,890],{"type":43,"tag":229,"props":886,"children":887},{},[888],{"type":49,"value":889},"RCA depth",{"type":43,"tag":229,"props":891,"children":892},{},[893,899,900,906,907,913,914],{"type":43,"tag":66,"props":894,"children":896},{"className":895},[],[897],{"type":49,"value":898},"ad_rca_detector_fingerprint",{"type":49,"value":105},{"type":43,"tag":66,"props":901,"children":903},{"className":902},[],[904],{"type":49,"value":905},"ad_rca_correlation",{"type":49,"value":105},{"type":43,"tag":66,"props":908,"children":910},{"className":909},[],[911],{"type":49,"value":912},"ad_rca_blast_radius",{"type":49,"value":105},{"type":43,"tag":66,"props":915,"children":917},{"className":916},[],[918],{"type":49,"value":919},"ad_rca_score_reassessment",{"type":43,"tag":207,"props":921,"children":922},{},[923,928],{"type":43,"tag":229,"props":924,"children":925},{},[926],{"type":49,"value":927},"Evidence \u002F categories",{"type":43,"tag":229,"props":929,"children":930},{},[931,937,938,944,945,951,952],{"type":43,"tag":66,"props":932,"children":934},{"className":933},[],[935],{"type":49,"value":936},"ad_get_job_datafeed_config",{"type":49,"value":105},{"type":43,"tag":66,"props":939,"children":941},{"className":940},[],[942],{"type":49,"value":943},"ad_rca_source_evidence",{"type":49,"value":105},{"type":43,"tag":66,"props":946,"children":948},{"className":947},[],[949],{"type":49,"value":950},"ad_get_categories",{"type":49,"value":105},{"type":43,"tag":66,"props":953,"children":955},{"className":954},[],[956],{"type":49,"value":957},"ad_search_log_category_examples",{"type":43,"tag":744,"props":959,"children":961},{"id":960},"protocol",[962],{"type":49,"value":963},"Protocol",{"type":43,"tag":52,"props":965,"children":966},{},[967,969,974,976,981,983,988,989,994,996,1001,1003,1008,1010,1016,1018,1023,1025,1030,1032,1037,1039,1045,1047,1052,1054,1059,1061,1066,1068,1074,1076,1081,1083,1088],{"type":49,"value":968},"Follow the 14-step sequence in ",{"type":43,"tag":161,"props":970,"children":972},{"href":971},"references\u002Fprotocols\u002Finvestigation.md",[973],{"type":49,"value":971},{"type":49,"value":975},". High\nlevel: ",{"type":43,"tag":66,"props":977,"children":979},{"className":978},[],[980],{"type":49,"value":788},{"type":49,"value":982}," → pair ",{"type":43,"tag":66,"props":984,"children":986},{"className":985},[],[987],{"type":49,"value":809},{"type":49,"value":421},{"type":43,"tag":66,"props":990,"children":992},{"className":991},[],[993],{"type":49,"value":802},{"type":49,"value":995}," →\n",{"type":43,"tag":66,"props":997,"children":999},{"className":998},[],[1000],{"type":49,"value":826},{"type":49,"value":1002}," → rank with ",{"type":43,"tag":66,"props":1004,"children":1006},{"className":1005},[],[1007],{"type":49,"value":850},{"type":49,"value":1009}," (",{"type":43,"tag":66,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":49,"value":1015},"min_job_count=2",{"type":49,"value":1017},") → ",{"type":43,"tag":66,"props":1019,"children":1021},{"className":1020},[],[1022],{"type":49,"value":898},{"type":49,"value":1024},"\n→ drill with ",{"type":43,"tag":66,"props":1026,"children":1028},{"className":1027},[],[1029],{"type":49,"value":874},{"type":49,"value":1031}," + ",{"type":43,"tag":66,"props":1033,"children":1035},{"className":1034},[],[1036],{"type":49,"value":881},{"type":49,"value":1038}," (low ",{"type":43,"tag":66,"props":1040,"children":1042},{"className":1041},[],[1043],{"type":49,"value":1044},"min_score=25",{"type":49,"value":1046},") → profile with\n",{"type":43,"tag":66,"props":1048,"children":1050},{"className":1049},[],[1051],{"type":49,"value":857},{"type":49,"value":1053}," → order with ",{"type":43,"tag":66,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":49,"value":905},{"type":49,"value":1060}," → confirm with ",{"type":43,"tag":66,"props":1062,"children":1064},{"className":1063},[],[1065],{"type":49,"value":943},{"type":49,"value":1067},". When\n",{"type":43,"tag":66,"props":1069,"children":1071},{"className":1070},[],[1072],{"type":49,"value":1073},"by_field_name == \"mlcategory\"",{"type":49,"value":1075},", compare with ",{"type":43,"tag":66,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":49,"value":950},{"type":49,"value":1082}," + paired ",{"type":43,"tag":66,"props":1084,"children":1086},{"className":1085},[],[1087],{"type":49,"value":957},{"type":49,"value":1089}," (baseline\nvs. anomaly window).",{"type":43,"tag":52,"props":1091,"children":1092},{},[1093,1095,1100,1102,1107,1109,1114],{"type":49,"value":1094},"Finish with a written RCA: ",{"type":43,"tag":58,"props":1096,"children":1097},{},[1098],{"type":49,"value":1099},"root cause entity · affected jobs · temporal progression · fault class\n(resource\u002Fnetwork\u002Fapplication) · severity · recommended actions",{"type":49,"value":1101},". Worked example:\n",{"type":43,"tag":161,"props":1103,"children":1105},{"href":1104},"references\u002Fworked-example.md",[1106],{"type":49,"value":1104},{"type":49,"value":1108},". Full ES|QL templates and parameters:\n",{"type":43,"tag":161,"props":1110,"children":1112},{"href":1111},"references\u002Finvestigate-anomaly-esql-tools.md",[1113],{"type":49,"value":1111},{"type":49,"value":192},{"type":43,"tag":744,"props":1116,"children":1118},{"id":1117},"rules",[1119],{"type":49,"value":1120},"Rules",{"type":43,"tag":1122,"props":1123,"children":1124},"ol",{},[1125,1141,1158,1173,1188],{"type":43,"tag":93,"props":1126,"children":1127},{},[1128,1133,1135,1140],{"type":43,"tag":58,"props":1129,"children":1130},{},[1131],{"type":49,"value":1132},"Multi-job entities are prime suspects; single-job entities are usually victims.",{"type":49,"value":1134}," Use ",{"type":43,"tag":66,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":49,"value":1015},{"type":49,"value":192},{"type":43,"tag":93,"props":1142,"children":1143},{},[1144,1149,1151,1156],{"type":43,"tag":58,"props":1145,"children":1146},{},[1147],{"type":49,"value":1148},"Earliest anomaly timestamp wins",{"type":49,"value":1150}," — sort ",{"type":43,"tag":66,"props":1152,"children":1154},{"className":1153},[],[1155],{"type":49,"value":905},{"type":49,"value":1157}," by timestamp; first-appearing entity = origin.",{"type":43,"tag":93,"props":1159,"children":1160},{},[1161,1171],{"type":43,"tag":58,"props":1162,"children":1163},{},[1164,1169],{"type":43,"tag":66,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":49,"value":397},{"type":49,"value":1170}," = sustained behavioral shift",{"type":49,"value":1172},", weight higher than transient spikes.",{"type":43,"tag":93,"props":1174,"children":1175},{},[1176,1186],{"type":43,"tag":58,"props":1177,"children":1178},{},[1179,1181],{"type":49,"value":1180},"Never close an RCA without ",{"type":43,"tag":66,"props":1182,"children":1184},{"className":1183},[],[1185],{"type":49,"value":943},{"type":49,"value":1187}," — raw source documents are ground truth.",{"type":43,"tag":93,"props":1189,"children":1190},{},[1191,1204],{"type":43,"tag":58,"props":1192,"children":1193},{},[1194,1196,1202],{"type":49,"value":1195},"Use low ",{"type":43,"tag":66,"props":1197,"children":1199},{"className":1198},[],[1200],{"type":49,"value":1201},"min_score",{"type":49,"value":1203}," (25 or lower) for influencer queries",{"type":49,"value":1205}," — high thresholds miss correlated entities.",{"type":43,"tag":338,"props":1207,"children":1208},{},[],{"type":43,"tag":82,"props":1210,"children":1212},{"id":1211},"mode-explain-score-model-behavior",[1213],{"type":49,"value":1214},"Mode: Explain — Score \u002F model behavior",{"type":43,"tag":52,"props":1216,"children":1217},{},[1218,1222],{"type":43,"tag":58,"props":1219,"children":1220},{},[1221],{"type":49,"value":740},{"type":49,"value":1223}," \"why is my score 30\u002F90?\", \"score dropped overnight\", \"what is renormalization?\", \"why wasn't this detected?\".",{"type":43,"tag":744,"props":1225,"children":1227},{"id":1226},"score-types",[1228],{"type":49,"value":1229},"Score types",{"type":43,"tag":199,"props":1231,"children":1232},{},[1233,1254],{"type":43,"tag":203,"props":1234,"children":1235},{},[1236],{"type":43,"tag":207,"props":1237,"children":1238},{},[1239,1244,1249],{"type":43,"tag":211,"props":1240,"children":1241},{},[1242],{"type":49,"value":1243},"Field",{"type":43,"tag":211,"props":1245,"children":1246},{},[1247],{"type":49,"value":1248},"Scope",{"type":43,"tag":211,"props":1250,"children":1251},{},[1252],{"type":49,"value":1253},"Meaning",{"type":43,"tag":222,"props":1255,"children":1256},{},[1257,1278,1305,1326],{"type":43,"tag":207,"props":1258,"children":1259},{},[1260,1268,1273],{"type":43,"tag":229,"props":1261,"children":1262},{},[1263],{"type":43,"tag":66,"props":1264,"children":1266},{"className":1265},[],[1267],{"type":49,"value":358},{"type":43,"tag":229,"props":1269,"children":1270},{},[1271],{"type":49,"value":1272},"Single record",{"type":43,"tag":229,"props":1274,"children":1275},{},[1276],{"type":49,"value":1277},"Normalized severity after renormalization.",{"type":43,"tag":207,"props":1279,"children":1280},{},[1281,1289,1293],{"type":43,"tag":229,"props":1282,"children":1283},{},[1284],{"type":43,"tag":66,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":49,"value":650},{"type":43,"tag":229,"props":1290,"children":1291},{},[1292],{"type":49,"value":1272},{"type":43,"tag":229,"props":1294,"children":1295},{},[1296,1298,1303],{"type":49,"value":1297},"Score at detection time. Gap vs ",{"type":43,"tag":66,"props":1299,"children":1301},{"className":1300},[],[1302],{"type":49,"value":358},{"type":49,"value":1304}," = renormalization drift.",{"type":43,"tag":207,"props":1306,"children":1307},{},[1308,1316,1321],{"type":43,"tag":229,"props":1309,"children":1310},{},[1311],{"type":43,"tag":66,"props":1312,"children":1314},{"className":1313},[],[1315],{"type":49,"value":529},{"type":43,"tag":229,"props":1317,"children":1318},{},[1319],{"type":49,"value":1320},"Bucket",{"type":43,"tag":229,"props":1322,"children":1323},{},[1324],{"type":49,"value":1325},"Aggregate severity across all detectors in a bucket.",{"type":43,"tag":207,"props":1327,"children":1328},{},[1329,1337,1342],{"type":43,"tag":229,"props":1330,"children":1331},{},[1332],{"type":43,"tag":66,"props":1333,"children":1335},{"className":1334},[],[1336],{"type":49,"value":600},{"type":43,"tag":229,"props":1338,"children":1339},{},[1340],{"type":49,"value":1341},"Entity × bucket",{"type":43,"tag":229,"props":1343,"children":1344},{},[1345],{"type":49,"value":1346},"How anomalous a specific entity is in that bucket.",{"type":43,"tag":744,"props":1348,"children":1350},{"id":1349},"anomaly_score_explanation-components",[1351,1356],{"type":43,"tag":66,"props":1352,"children":1354},{"className":1353},[],[1355],{"type":49,"value":464},{"type":49,"value":1357}," components",{"type":43,"tag":199,"props":1359,"children":1360},{},[1361,1382],{"type":43,"tag":203,"props":1362,"children":1363},{},[1364],{"type":43,"tag":207,"props":1365,"children":1366},{},[1367,1372,1377],{"type":43,"tag":211,"props":1368,"children":1369},{},[1370],{"type":49,"value":1371},"Component",{"type":43,"tag":211,"props":1373,"children":1374},{},[1375],{"type":49,"value":1376},"Effect",{"type":43,"tag":211,"props":1378,"children":1379},{},[1380],{"type":49,"value":1381},"What it means",{"type":43,"tag":222,"props":1383,"children":1384},{},[1385,1407,1428,1448,1469,1491],{"type":43,"tag":207,"props":1386,"children":1387},{},[1388,1397,1402],{"type":43,"tag":229,"props":1389,"children":1390},{},[1391],{"type":43,"tag":66,"props":1392,"children":1394},{"className":1393},[],[1395],{"type":49,"value":1396},"anomaly_length",{"type":43,"tag":229,"props":1398,"children":1399},{},[1400],{"type":49,"value":1401},"↑ score",{"type":43,"tag":229,"props":1403,"children":1404},{},[1405],{"type":49,"value":1406},"More consecutive anomalous buckets",{"type":43,"tag":207,"props":1408,"children":1409},{},[1410,1419,1423],{"type":43,"tag":229,"props":1411,"children":1412},{},[1413],{"type":43,"tag":66,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":49,"value":1418},"single_bucket_impact",{"type":43,"tag":229,"props":1420,"children":1421},{},[1422],{"type":49,"value":1401},{"type":43,"tag":229,"props":1424,"children":1425},{},[1426],{"type":49,"value":1427},"Lower probability → higher impact",{"type":43,"tag":207,"props":1429,"children":1430},{},[1431,1439,1443],{"type":43,"tag":229,"props":1432,"children":1433},{},[1434],{"type":43,"tag":66,"props":1435,"children":1437},{"className":1436},[],[1438],{"type":49,"value":721},{"type":43,"tag":229,"props":1440,"children":1441},{},[1442],{"type":49,"value":1401},{"type":43,"tag":229,"props":1444,"children":1445},{},[1446],{"type":49,"value":1447},"Sustained pattern contribution",{"type":43,"tag":207,"props":1449,"children":1450},{},[1451,1460,1464],{"type":43,"tag":229,"props":1452,"children":1453},{},[1454],{"type":43,"tag":66,"props":1455,"children":1457},{"className":1456},[],[1458],{"type":49,"value":1459},"anomaly_characteristics_impact",{"type":43,"tag":229,"props":1461,"children":1462},{},[1463],{"type":49,"value":1401},{"type":43,"tag":229,"props":1465,"children":1466},{},[1467],{"type":49,"value":1468},"Mean shift vs. variance change",{"type":43,"tag":207,"props":1470,"children":1471},{},[1472,1481,1486],{"type":43,"tag":229,"props":1473,"children":1474},{},[1475],{"type":43,"tag":66,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":49,"value":1480},"high_variance_penalty",{"type":43,"tag":229,"props":1482,"children":1483},{},[1484],{"type":49,"value":1485},"↓ score",{"type":43,"tag":229,"props":1487,"children":1488},{},[1489],{"type":49,"value":1490},"Noisy data → wide bounds → anomaly less surprising",{"type":43,"tag":207,"props":1492,"children":1493},{},[1494,1503,1507],{"type":43,"tag":229,"props":1495,"children":1496},{},[1497],{"type":43,"tag":66,"props":1498,"children":1500},{"className":1499},[],[1501],{"type":49,"value":1502},"incomplete_bucket_penalty",{"type":43,"tag":229,"props":1504,"children":1505},{},[1506],{"type":49,"value":1485},{"type":43,"tag":229,"props":1508,"children":1509},{},[1510],{"type":49,"value":1511},"Bucket has less data than expected (ingest lag, sparse data)",{"type":43,"tag":744,"props":1513,"children":1515},{"id":1514},"why-a-score-looks-wrong",[1516],{"type":49,"value":1517},"Why a score looks wrong",{"type":43,"tag":89,"props":1519,"children":1520},{},[1521,1574],{"type":43,"tag":93,"props":1522,"children":1523},{},[1524,1529,1531,1536,1538,1543,1545,1551,1552,1558,1560,1565,1567,1573],{"type":43,"tag":58,"props":1525,"children":1526},{},[1527],{"type":49,"value":1528},"Unexpectedly low:",{"type":49,"value":1530}," ",{"type":43,"tag":66,"props":1532,"children":1534},{"className":1533},[],[1535],{"type":49,"value":1480},{"type":49,"value":1537},", renormalization, \u003C3 weeks training for weekly seasonality,\n",{"type":43,"tag":66,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":49,"value":521},{"type":49,"value":1544}," too large, wrong detector function (",{"type":43,"tag":66,"props":1546,"children":1548},{"className":1547},[],[1549],{"type":49,"value":1550},"mean",{"type":49,"value":553},{"type":43,"tag":66,"props":1553,"children":1555},{"className":1554},[],[1556],{"type":49,"value":1557},"high_mean",{"type":49,"value":1559},"), ",{"type":43,"tag":66,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":49,"value":1502},{"type":49,"value":1566},", suppression by\n",{"type":43,"tag":66,"props":1568,"children":1570},{"className":1569},[],[1571],{"type":49,"value":1572},"custom_rules",{"type":49,"value":192},{"type":43,"tag":93,"props":1575,"children":1576},{},[1577,1582,1584,1590],{"type":43,"tag":58,"props":1578,"children":1579},{},[1580],{"type":49,"value":1581},"Unexpectedly high:",{"type":49,"value":1583}," insufficient history (early training over-flags), high-cardinality split (too few points per\nentity), ",{"type":43,"tag":66,"props":1585,"children":1587},{"className":1586},[],[1588],{"type":49,"value":1589},"use_null: true",{"type":49,"value":1591}," on a sparse field.",{"type":43,"tag":744,"props":1593,"children":1595},{"id":1594},"tool-chain-1",[1596],{"type":49,"value":749},{"type":43,"tag":199,"props":1598,"children":1599},{},[1600,1615],{"type":43,"tag":203,"props":1601,"children":1602},{},[1603],{"type":43,"tag":207,"props":1604,"children":1605},{},[1606,1611],{"type":43,"tag":211,"props":1607,"children":1608},{},[1609],{"type":49,"value":1610},"Purpose",{"type":43,"tag":211,"props":1612,"children":1613},{},[1614],{"type":49,"value":768},{"type":43,"tag":222,"props":1616,"children":1617},{},[1618,1643,1667,1701,1718,1734,1771,1787,1804],{"type":43,"tag":207,"props":1619,"children":1620},{},[1621,1626],{"type":43,"tag":229,"props":1622,"children":1623},{},[1624],{"type":49,"value":1625},"Records + explanation",{"type":43,"tag":229,"props":1627,"children":1628},{},[1629,1634,1636,1642],{"type":43,"tag":66,"props":1630,"children":1632},{"className":1631},[],[1633],{"type":49,"value":874},{"type":49,"value":1635}," (exact ",{"type":43,"tag":66,"props":1637,"children":1639},{"className":1638},[],[1640],{"type":49,"value":1641},"job_id_pattern",{"type":49,"value":146},{"type":43,"tag":207,"props":1644,"children":1645},{},[1646,1651],{"type":43,"tag":229,"props":1647,"children":1648},{},[1649],{"type":49,"value":1650},"Renormalization drift",{"type":43,"tag":229,"props":1652,"children":1653},{},[1654,1659,1660,1666],{"type":43,"tag":66,"props":1655,"children":1657},{"className":1656},[],[1658],{"type":49,"value":919},{"type":49,"value":1009},{"type":43,"tag":66,"props":1661,"children":1663},{"className":1662},[],[1664],{"type":49,"value":1665},"score_drift = initial_record_score - record_score",{"type":49,"value":146},{"type":43,"tag":207,"props":1668,"children":1669},{},[1670,1675],{"type":43,"tag":229,"props":1671,"children":1672},{},[1673],{"type":49,"value":1674},"Model bounds (visual)",{"type":43,"tag":229,"props":1676,"children":1677},{},[1678,1684,1686,1692,1693,1699],{"type":43,"tag":66,"props":1679,"children":1681},{"className":1680},[],[1682],{"type":49,"value":1683},"ad_get_model_plot",{"type":49,"value":1685}," — actual outside ",{"type":43,"tag":66,"props":1687,"children":1689},{"className":1688},[],[1690],{"type":49,"value":1691},"model_lower",{"type":49,"value":429},{"type":43,"tag":66,"props":1694,"children":1696},{"className":1695},[],[1697],{"type":49,"value":1698},"model_upper",{"type":49,"value":1700}," = anomaly",{"type":43,"tag":207,"props":1702,"children":1703},{},[1704,1709],{"type":43,"tag":229,"props":1705,"children":1706},{},[1707],{"type":49,"value":1708},"Forecast overlap",{"type":43,"tag":229,"props":1710,"children":1711},{},[1712],{"type":43,"tag":66,"props":1713,"children":1715},{"className":1714},[],[1716],{"type":49,"value":1717},"ad_get_forecast_results",{"type":43,"tag":207,"props":1719,"children":1720},{},[1721,1726],{"type":43,"tag":229,"props":1722,"children":1723},{},[1724],{"type":49,"value":1725},"Influencer attribution",{"type":43,"tag":229,"props":1727,"children":1728},{},[1729],{"type":43,"tag":66,"props":1730,"children":1732},{"className":1731},[],[1733],{"type":49,"value":881},{"type":43,"tag":207,"props":1735,"children":1736},{},[1737,1742],{"type":43,"tag":229,"props":1738,"children":1739},{},[1740],{"type":49,"value":1741},"Config & detector",{"type":43,"tag":229,"props":1743,"children":1744},{},[1745,1750,1752,1757,1759,1764,1765],{"type":43,"tag":66,"props":1746,"children":1748},{"className":1747},[],[1749],{"type":49,"value":936},{"type":49,"value":1751}," — ",{"type":43,"tag":66,"props":1753,"children":1755},{"className":1754},[],[1756],{"type":49,"value":521},{"type":49,"value":1758},", function, ",{"type":43,"tag":66,"props":1760,"children":1762},{"className":1761},[],[1763],{"type":49,"value":1572},{"type":49,"value":105},{"type":43,"tag":66,"props":1766,"children":1768},{"className":1767},[],[1769],{"type":49,"value":1770},"use_null",{"type":43,"tag":207,"props":1772,"children":1773},{},[1774,1779],{"type":43,"tag":229,"props":1775,"children":1776},{},[1777],{"type":49,"value":1778},"Categorization",{"type":43,"tag":229,"props":1780,"children":1781},{},[1782],{"type":43,"tag":66,"props":1783,"children":1785},{"className":1784},[],[1786],{"type":49,"value":950},{"type":43,"tag":207,"props":1788,"children":1789},{},[1790,1795],{"type":43,"tag":229,"props":1791,"children":1792},{},[1793],{"type":49,"value":1794},"Model snapshots",{"type":43,"tag":229,"props":1796,"children":1797},{},[1798],{"type":43,"tag":66,"props":1799,"children":1801},{"className":1800},[],[1802],{"type":49,"value":1803},"ad_get_model_snapshots",{"type":43,"tag":207,"props":1805,"children":1806},{},[1807,1812],{"type":43,"tag":229,"props":1808,"children":1809},{},[1810],{"type":49,"value":1811},"Structured diagnostic",{"type":43,"tag":229,"props":1813,"children":1814},{},[1815,1824],{"type":43,"tag":58,"props":1816,"children":1817},{},[1818],{"type":43,"tag":66,"props":1819,"children":1821},{"className":1820},[],[1822],{"type":49,"value":1823},"ad_wf_troubleshoot_anomaly_score",{"type":49,"value":1825}," (full decision tree)",{"type":43,"tag":744,"props":1827,"children":1829},{"id":1828},"decision-tree-ad_wf_troubleshoot_anomaly_score",[1830,1832,1837],{"type":49,"value":1831},"Decision tree (",{"type":43,"tag":66,"props":1833,"children":1835},{"className":1834},[],[1836],{"type":49,"value":1823},{"type":49,"value":146},{"type":43,"tag":1122,"props":1839,"children":1840},{},[1841,1851,1869,1880,1902,1930,1946,1956],{"type":43,"tag":93,"props":1842,"children":1843},{},[1844,1849],{"type":43,"tag":66,"props":1845,"children":1847},{"className":1846},[],[1848],{"type":49,"value":795},{"type":49,"value":1850}," — ≥3 weeks data for weekly seasonality?",{"type":43,"tag":93,"props":1852,"children":1853},{},[1854,1860,1861,1867],{"type":43,"tag":66,"props":1855,"children":1857},{"className":1856},[],[1858],{"type":49,"value":1859},"ad_ts_model_memory_health",{"type":49,"value":1751},{"type":43,"tag":66,"props":1862,"children":1864},{"className":1863},[],[1865],{"type":49,"value":1866},"memory_status",{"type":49,"value":1868}," healthy?",{"type":43,"tag":93,"props":1870,"children":1871},{},[1872,1878],{"type":43,"tag":66,"props":1873,"children":1875},{"className":1874},[],[1876],{"type":49,"value":1877},"ad_ts_delayed_data_annotations",{"type":49,"value":1879}," — no incomplete buckets?",{"type":43,"tag":93,"props":1881,"children":1882},{},[1883,1888,1890,1895,1896,1901],{"type":43,"tag":66,"props":1884,"children":1886},{"className":1885},[],[1887],{"type":49,"value":874},{"type":49,"value":1889}," — compare ",{"type":43,"tag":66,"props":1891,"children":1893},{"className":1892},[],[1894],{"type":49,"value":358},{"type":49,"value":553},{"type":43,"tag":66,"props":1897,"children":1899},{"className":1898},[],[1900],{"type":49,"value":650},{"type":49,"value":192},{"type":43,"tag":93,"props":1903,"children":1904},{},[1905,1910,1911,1916,1918,1923,1924,1929],{"type":43,"tag":66,"props":1906,"children":1908},{"className":1907},[],[1909],{"type":49,"value":936},{"type":49,"value":1751},{"type":43,"tag":66,"props":1912,"children":1914},{"className":1913},[],[1915],{"type":49,"value":521},{"type":49,"value":1917},", detector function, ",{"type":43,"tag":66,"props":1919,"children":1921},{"className":1920},[],[1922],{"type":49,"value":1572},{"type":49,"value":105},{"type":43,"tag":66,"props":1925,"children":1927},{"className":1926},[],[1928],{"type":49,"value":1770},{"type":49,"value":192},{"type":43,"tag":93,"props":1931,"children":1932},{},[1933,1938,1940,1945],{"type":43,"tag":66,"props":1934,"children":1936},{"className":1935},[],[1937],{"type":49,"value":1683},{"type":49,"value":1939}," — wide bounds → ",{"type":43,"tag":66,"props":1941,"children":1943},{"className":1942},[],[1944],{"type":49,"value":1480},{"type":49,"value":192},{"type":43,"tag":93,"props":1947,"children":1948},{},[1949,1954],{"type":43,"tag":66,"props":1950,"children":1952},{"className":1951},[],[1953],{"type":49,"value":919},{"type":49,"value":1955}," — renormalization drift across history.",{"type":43,"tag":93,"props":1957,"children":1958},{},[1959,1961,1966],{"type":49,"value":1960},"Explain ",{"type":43,"tag":66,"props":1962,"children":1964},{"className":1963},[],[1965],{"type":49,"value":464},{"type":49,"value":1967}," factors.",{"type":43,"tag":744,"props":1969,"children":1971},{"id":1970},"rules-1",[1972],{"type":49,"value":1120},{"type":43,"tag":1122,"props":1974,"children":1975},{},[1976,1998,2008,2035,2056],{"type":43,"tag":93,"props":1977,"children":1978},{},[1979,1996],{"type":43,"tag":58,"props":1980,"children":1981},{},[1982,1984,1989,1991],{"type":49,"value":1983},"Always show both ",{"type":43,"tag":66,"props":1985,"children":1987},{"className":1986},[],[1988],{"type":49,"value":650},{"type":49,"value":1990}," and ",{"type":43,"tag":66,"props":1992,"children":1994},{"className":1993},[],[1995],{"type":49,"value":358},{"type":49,"value":1997}," — the gap is the renormalization story.",{"type":43,"tag":93,"props":1999,"children":2000},{},[2001,2006],{"type":43,"tag":58,"props":2002,"children":2003},{},[2004],{"type":49,"value":2005},"Explain renormalization before diagnosing config",{"type":49,"value":2007}," — score drift is the most common \"score dropped\" cause and needs\nno config change.",{"type":43,"tag":93,"props":2009,"children":2010},{},[2011,2033],{"type":43,"tag":58,"props":2012,"children":2013},{},[2014,2019,2020,2025,2026,2031],{"type":43,"tag":66,"props":2015,"children":2017},{"className":2016},[],[2018],{"type":49,"value":419},{"type":49,"value":421},{"type":43,"tag":66,"props":2021,"children":2023},{"className":2022},[],[2024],{"type":49,"value":427},{"type":49,"value":429},{"type":43,"tag":66,"props":2027,"children":2029},{"className":2028},[],[2030],{"type":49,"value":435},{"type":49,"value":2032}," is an absence anomaly",{"type":49,"value":2034}," — distinguish outages from value spikes.",{"type":43,"tag":93,"props":2036,"children":2037},{},[2038,2054],{"type":43,"tag":58,"props":2039,"children":2040},{},[2041,2046,2047,2052],{"type":43,"tag":66,"props":2042,"children":2044},{"className":2043},[],[2045],{"type":49,"value":1480},{"type":49,"value":1990},{"type":43,"tag":66,"props":2048,"children":2050},{"className":2049},[],[2051],{"type":49,"value":1502},{"type":49,"value":2053}," explain most \"low score\" surprises",{"type":49,"value":2055}," without remediation.",{"type":43,"tag":93,"props":2057,"children":2058},{},[2059,2064],{"type":43,"tag":58,"props":2060,"children":2061},{},[2062],{"type":49,"value":2063},"Weekly seasonality needs ≥3 weeks of training data",{"type":49,"value":2065}," — flag young jobs as the cause.",{"type":43,"tag":52,"props":2067,"children":2068},{},[2069,2071,2076],{"type":49,"value":2070},"For detector function selection details, see\n",{"type":43,"tag":161,"props":2072,"children":2074},{"href":2073},"references\u002Fanomaly-detection-functions.md",[2075],{"type":49,"value":2073},{"type":49,"value":192},{"type":43,"tag":338,"props":2078,"children":2079},{},[],{"type":43,"tag":82,"props":2081,"children":2083},{"id":2082},"mode-troubleshoot-job-ops",[2084],{"type":49,"value":2085},"Mode: Troubleshoot — Job ops",{"type":43,"tag":52,"props":2087,"children":2088},{},[2089,2093],{"type":43,"tag":58,"props":2090,"children":2091},{},[2092],{"type":49,"value":740},{"type":49,"value":2094}," \"missing documents\", \"datafeed stopped\", \"hard_limit\", \"results look wrong\", lifecycle changes, calendars,\nCCS.",{"type":43,"tag":744,"props":2096,"children":2098},{"id":2097},"common-issues-fast-paths",[2099],{"type":49,"value":2100},"Common issues → fast paths",{"type":43,"tag":199,"props":2102,"children":2103},{},[2104,2125],{"type":43,"tag":203,"props":2105,"children":2106},{},[2107],{"type":43,"tag":207,"props":2108,"children":2109},{},[2110,2115,2120],{"type":43,"tag":211,"props":2111,"children":2112},{},[2113],{"type":49,"value":2114},"Issue",{"type":43,"tag":211,"props":2116,"children":2117},{},[2118],{"type":49,"value":2119},"Fast path",{"type":43,"tag":211,"props":2121,"children":2122},{},[2123],{"type":49,"value":2124},"Full decision tree",{"type":43,"tag":222,"props":2126,"children":2127},{},[2128,2183,2242,2278,2307],{"type":43,"tag":207,"props":2129,"children":2130},{},[2131,2144,2174],{"type":43,"tag":229,"props":2132,"children":2133},{},[2134,2136,2142],{"type":49,"value":2135},"Missing docs \u002F ",{"type":43,"tag":66,"props":2137,"children":2139},{"className":2138},[],[2140],{"type":49,"value":2141},"query_delay",{"type":49,"value":2143}," warning",{"type":43,"tag":229,"props":2145,"children":2146},{},[2147,2152,2154,2160,2161,2167,2168],{"type":43,"tag":66,"props":2148,"children":2150},{"className":2149},[],[2151],{"type":49,"value":1877},{"type":49,"value":2153}," → ",{"type":43,"tag":66,"props":2155,"children":2157},{"className":2156},[],[2158],{"type":49,"value":2159},"ad_ts_bucket_event_gaps",{"type":49,"value":2153},{"type":43,"tag":66,"props":2162,"children":2164},{"className":2163},[],[2165],{"type":49,"value":2166},"ad_ts_ingest_latency_estimate",{"type":49,"value":2153},{"type":43,"tag":66,"props":2169,"children":2171},{"className":2170},[],[2172],{"type":49,"value":2173},"ad_update_datafeed_query_delay",{"type":43,"tag":229,"props":2175,"children":2176},{},[2177],{"type":43,"tag":66,"props":2178,"children":2180},{"className":2179},[],[2181],{"type":49,"value":2182},"ad_wf_troubleshoot_query_delay",{"type":43,"tag":207,"props":2184,"children":2185},{},[2186,2204,2233],{"type":43,"tag":229,"props":2187,"children":2188},{},[2189,2191,2197,2198],{"type":49,"value":2190},"Memory ",{"type":43,"tag":66,"props":2192,"children":2194},{"className":2193},[],[2195],{"type":49,"value":2196},"soft_limit",{"type":49,"value":620},{"type":43,"tag":66,"props":2199,"children":2201},{"className":2200},[],[2202],{"type":49,"value":2203},"hard_limit",{"type":43,"tag":229,"props":2205,"children":2206},{},[2207,2212,2213,2219,2220,2226,2227],{"type":43,"tag":66,"props":2208,"children":2210},{"className":2209},[],[2211],{"type":49,"value":1859},{"type":49,"value":2153},{"type":43,"tag":66,"props":2214,"children":2216},{"className":2215},[],[2217],{"type":49,"value":2218},"ad_wf_ts_field_cardinality",{"type":49,"value":2153},{"type":43,"tag":66,"props":2221,"children":2223},{"className":2222},[],[2224],{"type":49,"value":2225},"ad_estimate_memory_requirement",{"type":49,"value":2153},{"type":43,"tag":66,"props":2228,"children":2230},{"className":2229},[],[2231],{"type":49,"value":2232},"ad_update_model_memory_limit",{"type":43,"tag":229,"props":2234,"children":2235},{},[2236],{"type":43,"tag":66,"props":2237,"children":2239},{"className":2238},[],[2240],{"type":49,"value":2241},"ad_wf_troubleshoot_memory_limit",{"type":43,"tag":207,"props":2243,"children":2244},{},[2245,2250,2273],{"type":43,"tag":229,"props":2246,"children":2247},{},[2248],{"type":49,"value":2249},"Datafeed not running \u002F job state",{"type":43,"tag":229,"props":2251,"children":2252},{},[2253,2258,2260,2266,2267],{"type":43,"tag":66,"props":2254,"children":2256},{"className":2255},[],[2257],{"type":49,"value":795},{"type":49,"value":2259}," (state) → ",{"type":43,"tag":66,"props":2261,"children":2263},{"className":2262},[],[2264],{"type":49,"value":2265},"ad_get_job_messages",{"type":49,"value":2153},{"type":43,"tag":66,"props":2268,"children":2270},{"className":2269},[],[2271],{"type":49,"value":2272},"ad_manage_datafeed",{"type":43,"tag":229,"props":2274,"children":2275},{},[2276],{"type":49,"value":2277},"—",{"type":43,"tag":207,"props":2279,"children":2280},{},[2281,2294,2303],{"type":43,"tag":229,"props":2282,"children":2283},{},[2284,2286,2292],{"type":49,"value":2285},"CCS \u002F ",{"type":43,"tag":66,"props":2287,"children":2289},{"className":2288},[],[2290],{"type":49,"value":2291},"remote_cluster:",{"type":49,"value":2293}," indices",{"type":43,"tag":229,"props":2295,"children":2296},{},[2297],{"type":43,"tag":66,"props":2298,"children":2300},{"className":2299},[],[2301],{"type":49,"value":2302},"ad_ts_ccs_diagnostics",{"type":43,"tag":229,"props":2304,"children":2305},{},[2306],{"type":49,"value":2277},{"type":43,"tag":207,"props":2308,"children":2309},{},[2310,2315,2319],{"type":43,"tag":229,"props":2311,"children":2312},{},[2313],{"type":49,"value":2314},"Score sanity check",{"type":43,"tag":229,"props":2316,"children":2317},{},[2318],{"type":49,"value":2277},{"type":43,"tag":229,"props":2320,"children":2321},{},[2322],{"type":43,"tag":66,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":49,"value":1823},{"type":43,"tag":451,"props":2328,"children":2329},{},[2330],{"type":43,"tag":52,"props":2331,"children":2332},{},[2333,2338,2340],{"type":43,"tag":66,"props":2334,"children":2336},{"className":2335},[],[2337],{"type":49,"value":2203},{"type":49,"value":2339}," corrupts model state and causes downstream missing-doc false alarms (categorizer silently skips events\nfor unknown categories). ",{"type":43,"tag":58,"props":2341,"children":2342},{},[2343,2345,2350],{"type":49,"value":2344},"Fix memory before fixing ",{"type":43,"tag":66,"props":2346,"children":2348},{"className":2347},[],[2349],{"type":49,"value":2141},{"type":49,"value":192},{"type":43,"tag":744,"props":2352,"children":2354},{"id":2353},"memory-concepts",[2355],{"type":49,"value":2356},"Memory concepts",{"type":43,"tag":199,"props":2358,"children":2359},{},[2360,2374],{"type":43,"tag":203,"props":2361,"children":2362},{},[2363],{"type":43,"tag":207,"props":2364,"children":2365},{},[2366,2370],{"type":43,"tag":211,"props":2367,"children":2368},{},[2369],{"type":49,"value":1243},{"type":43,"tag":211,"props":2371,"children":2372},{},[2373],{"type":49,"value":1253},{"type":43,"tag":222,"props":2375,"children":2376},{},[2377,2394,2411,2434,2469,2492,2509],{"type":43,"tag":207,"props":2378,"children":2379},{},[2380,2389],{"type":43,"tag":229,"props":2381,"children":2382},{},[2383],{"type":43,"tag":66,"props":2384,"children":2386},{"className":2385},[],[2387],{"type":49,"value":2388},"model_bytes",{"type":43,"tag":229,"props":2390,"children":2391},{},[2392],{"type":49,"value":2393},"Current memory used",{"type":43,"tag":207,"props":2395,"children":2396},{},[2397,2406],{"type":43,"tag":229,"props":2398,"children":2399},{},[2400],{"type":43,"tag":66,"props":2401,"children":2403},{"className":2402},[],[2404],{"type":49,"value":2405},"peak_model_bytes",{"type":43,"tag":229,"props":2407,"children":2408},{},[2409],{"type":49,"value":2410},"High-water mark since job opened",{"type":43,"tag":207,"props":2412,"children":2413},{},[2414,2423],{"type":43,"tag":229,"props":2415,"children":2416},{},[2417],{"type":43,"tag":66,"props":2418,"children":2420},{"className":2419},[],[2421],{"type":49,"value":2422},"model_bytes_memory_limit",{"type":43,"tag":229,"props":2424,"children":2425},{},[2426,2428],{"type":49,"value":2427},"Configured ",{"type":43,"tag":66,"props":2429,"children":2431},{"className":2430},[],[2432],{"type":49,"value":2433},"model_memory_limit",{"type":43,"tag":207,"props":2435,"children":2436},{},[2437,2445],{"type":43,"tag":229,"props":2438,"children":2439},{},[2440],{"type":43,"tag":66,"props":2441,"children":2443},{"className":2442},[],[2444],{"type":49,"value":1866},{"type":43,"tag":229,"props":2446,"children":2447},{},[2448,2454,2455,2460,2462,2467],{"type":43,"tag":66,"props":2449,"children":2451},{"className":2450},[],[2452],{"type":49,"value":2453},"ok",{"type":49,"value":620},{"type":43,"tag":66,"props":2456,"children":2458},{"className":2457},[],[2459],{"type":49,"value":2196},{"type":49,"value":2461}," (pruning) \u002F ",{"type":43,"tag":66,"props":2463,"children":2465},{"className":2464},[],[2466],{"type":49,"value":2203},{"type":49,"value":2468}," (critical)",{"type":43,"tag":207,"props":2470,"children":2471},{},[2472,2481],{"type":43,"tag":229,"props":2473,"children":2474},{},[2475],{"type":43,"tag":66,"props":2476,"children":2478},{"className":2477},[],[2479],{"type":49,"value":2480},"total_by_field_count > 100k",{"type":43,"tag":229,"props":2482,"children":2483},{},[2484,2490],{"type":43,"tag":66,"props":2485,"children":2487},{"className":2486},[],[2488],{"type":49,"value":2489},"by_field",{"type":49,"value":2491}," cardinality too high — dominant driver",{"type":43,"tag":207,"props":2493,"children":2494},{},[2495,2504],{"type":43,"tag":229,"props":2496,"children":2497},{},[2498],{"type":43,"tag":66,"props":2499,"children":2501},{"className":2500},[],[2502],{"type":49,"value":2503},"total_partition_field_count > 10k",{"type":43,"tag":229,"props":2505,"children":2506},{},[2507],{"type":49,"value":2508},"Partition explosion",{"type":43,"tag":207,"props":2510,"children":2511},{},[2512,2521],{"type":43,"tag":229,"props":2513,"children":2514},{},[2515],{"type":43,"tag":66,"props":2516,"children":2518},{"className":2517},[],[2519],{"type":49,"value":2520},"total_category_count > 10k",{"type":43,"tag":229,"props":2522,"children":2523},{},[2524],{"type":49,"value":2525},"Too many distinct log patterns",{"type":43,"tag":52,"props":2527,"children":2528},{},[2529,2531,2539,2541,2547],{"type":49,"value":2530},"Prefer ",{"type":43,"tag":58,"props":2532,"children":2533},{},[2534],{"type":43,"tag":66,"props":2535,"children":2537},{"className":2536},[],[2538],{"type":49,"value":2225},{"type":49,"value":2540}," (samples cardinality from source, calls Estimate Model Memory API) over\nheuristics like ",{"type":43,"tag":66,"props":2542,"children":2544},{"className":2543},[],[2545],{"type":49,"value":2546},"peak_model_bytes * 1.3",{"type":49,"value":2548}," — the heuristic ignores pure influencer and categorization memory.",{"type":43,"tag":744,"props":2550,"children":2552},{"id":2551},"datafeed-timing-concepts",[2553],{"type":49,"value":2554},"Datafeed & timing concepts",{"type":43,"tag":89,"props":2556,"children":2557},{},[2558,2593,2607,2620],{"type":43,"tag":93,"props":2559,"children":2560},{},[2561,2569,2571,2576,2578,2584,2586,2592],{"type":43,"tag":58,"props":2562,"children":2563},{},[2564],{"type":43,"tag":66,"props":2565,"children":2567},{"className":2566},[],[2568],{"type":49,"value":2141},{"type":49,"value":2570}," — how far behind real time the datafeed queries. Too small → missing docs; too large → slower\nalerts. Set to ",{"type":43,"tag":58,"props":2572,"children":2573},{},[2574],{"type":49,"value":2575},"P95 ingest latency + buffer",{"type":49,"value":2577}," (default ",{"type":43,"tag":66,"props":2579,"children":2581},{"className":2580},[],[2582],{"type":49,"value":2583},"60s",{"type":49,"value":2585},"–",{"type":43,"tag":66,"props":2587,"children":2589},{"className":2588},[],[2590],{"type":49,"value":2591},"120s",{"type":49,"value":602},{"type":43,"tag":93,"props":2594,"children":2595},{},[2596,2605],{"type":43,"tag":58,"props":2597,"children":2598},{},[2599],{"type":43,"tag":66,"props":2600,"children":2602},{"className":2601},[],[2603],{"type":49,"value":2604},"delayed_data_check_config",{"type":49,"value":2606}," — how aggressively the datafeed checks for late data.",{"type":43,"tag":93,"props":2608,"children":2609},{},[2610,2618],{"type":43,"tag":58,"props":2611,"children":2612},{},[2613],{"type":43,"tag":66,"props":2614,"children":2616},{"className":2615},[],[2617],{"type":49,"value":521},{"type":49,"value":2619}," — analysis interval. Align with data granularity and detection window.",{"type":43,"tag":93,"props":2621,"children":2622},{},[2623,2632,2634,2640],{"type":43,"tag":58,"props":2624,"children":2625},{},[2626],{"type":43,"tag":66,"props":2627,"children":2629},{"className":2628},[],[2630],{"type":49,"value":2631},"frequency",{"type":49,"value":2633}," — defaults to ",{"type":43,"tag":66,"props":2635,"children":2637},{"className":2636},[],[2638],{"type":49,"value":2639},"min(query_delay, bucket_span \u002F 2)",{"type":49,"value":192},{"type":43,"tag":744,"props":2642,"children":2644},{"id":2643},"lifecycle-for-config-changes-memory-limit-query_delay",[2645],{"type":49,"value":2646},"Lifecycle for config changes (memory limit, query_delay)",{"type":43,"tag":1122,"props":2648,"children":2649},{},[2650,2668,2673,2696,2707],{"type":43,"tag":93,"props":2651,"children":2652},{},[2653,2655,2660,2661,2667],{"type":49,"value":2654},"Stop datafeed: ",{"type":43,"tag":66,"props":2656,"children":2658},{"className":2657},[],[2659],{"type":49,"value":2272},{"type":49,"value":1009},{"type":43,"tag":66,"props":2662,"children":2664},{"className":2663},[],[2665],{"type":49,"value":2666},"action=_stop",{"type":49,"value":146},{"type":43,"tag":93,"props":2669,"children":2670},{},[2671],{"type":49,"value":2672},"Close job",{"type":43,"tag":93,"props":2674,"children":2675},{},[2676,2678,2683,2684,2689,2690],{"type":49,"value":2677},"Update config: ",{"type":43,"tag":66,"props":2679,"children":2681},{"className":2680},[],[2682],{"type":49,"value":2232},{"type":49,"value":105},{"type":43,"tag":66,"props":2685,"children":2687},{"className":2686},[],[2688],{"type":49,"value":2173},{"type":49,"value":574},{"type":43,"tag":66,"props":2691,"children":2693},{"className":2692},[],[2694],{"type":49,"value":2695},"ad_update_delayed_data_check_config",{"type":43,"tag":93,"props":2697,"children":2698},{},[2699,2701],{"type":49,"value":2700},"Open job: ",{"type":43,"tag":66,"props":2702,"children":2704},{"className":2703},[],[2705],{"type":49,"value":2706},"ad_open_job",{"type":43,"tag":93,"props":2708,"children":2709},{},[2710,2712,2717,2718,2724],{"type":49,"value":2711},"Start datafeed: ",{"type":43,"tag":66,"props":2713,"children":2715},{"className":2714},[],[2716],{"type":49,"value":2272},{"type":49,"value":1009},{"type":43,"tag":66,"props":2719,"children":2721},{"className":2720},[],[2722],{"type":49,"value":2723},"action=_start",{"type":49,"value":146},{"type":43,"tag":52,"props":2726,"children":2727},{},[2728,2730,2736],{"type":49,"value":2729},"Recover a corrupted period without resetting the whole model: ",{"type":43,"tag":66,"props":2731,"children":2733},{"className":2732},[],[2734],{"type":49,"value":2735},"ad_revert_model_snapshot",{"type":49,"value":192},{"type":43,"tag":744,"props":2738,"children":2740},{"id":2739},"tool-surface",[2741],{"type":49,"value":2742},"Tool surface",{"type":43,"tag":199,"props":2744,"children":2745},{},[2746,2761],{"type":43,"tag":203,"props":2747,"children":2748},{},[2749],{"type":43,"tag":207,"props":2750,"children":2751},{},[2752,2757],{"type":43,"tag":211,"props":2753,"children":2754},{},[2755],{"type":49,"value":2756},"Category",{"type":43,"tag":211,"props":2758,"children":2759},{},[2760],{"type":49,"value":768},{"type":43,"tag":222,"props":2762,"children":2763},{},[2764,2792,2827,2873,2913,2948,2964],{"type":43,"tag":207,"props":2765,"children":2766},{},[2767,2772],{"type":43,"tag":229,"props":2768,"children":2769},{},[2770],{"type":49,"value":2771},"Permissions \u002F metadata",{"type":43,"tag":229,"props":2773,"children":2774},{},[2775,2780,2781,2786,2787],{"type":43,"tag":66,"props":2776,"children":2778},{"className":2777},[],[2779],{"type":49,"value":181},{"type":49,"value":105},{"type":43,"tag":66,"props":2782,"children":2784},{"className":2783},[],[2785],{"type":49,"value":788},{"type":49,"value":105},{"type":43,"tag":66,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":49,"value":795},{"type":43,"tag":207,"props":2793,"children":2794},{},[2795,2800],{"type":43,"tag":229,"props":2796,"children":2797},{},[2798],{"type":49,"value":2799},"Job + datafeed state",{"type":43,"tag":229,"props":2801,"children":2802},{},[2803,2808,2809,2814,2815,2820,2821],{"type":43,"tag":66,"props":2804,"children":2806},{"className":2805},[],[2807],{"type":49,"value":936},{"type":49,"value":105},{"type":43,"tag":66,"props":2810,"children":2812},{"className":2811},[],[2813],{"type":49,"value":2265},{"type":49,"value":105},{"type":43,"tag":66,"props":2816,"children":2818},{"className":2817},[],[2819],{"type":49,"value":2272},{"type":49,"value":105},{"type":43,"tag":66,"props":2822,"children":2824},{"className":2823},[],[2825],{"type":49,"value":2826},"ad_preview_datafeed_with_latency",{"type":43,"tag":207,"props":2828,"children":2829},{},[2830,2835],{"type":43,"tag":229,"props":2831,"children":2832},{},[2833],{"type":49,"value":2834},"Timing \u002F missing docs",{"type":43,"tag":229,"props":2836,"children":2837},{},[2838,2843,2844,2849,2850,2855,2856,2861,2862,2867,2868],{"type":43,"tag":66,"props":2839,"children":2841},{"className":2840},[],[2842],{"type":49,"value":1877},{"type":49,"value":105},{"type":43,"tag":66,"props":2845,"children":2847},{"className":2846},[],[2848],{"type":49,"value":2159},{"type":49,"value":105},{"type":43,"tag":66,"props":2851,"children":2853},{"className":2852},[],[2854],{"type":49,"value":2166},{"type":49,"value":105},{"type":43,"tag":66,"props":2857,"children":2859},{"className":2858},[],[2860],{"type":49,"value":2173},{"type":49,"value":105},{"type":43,"tag":66,"props":2863,"children":2865},{"className":2864},[],[2866],{"type":49,"value":2695},{"type":49,"value":105},{"type":43,"tag":66,"props":2869,"children":2871},{"className":2870},[],[2872],{"type":49,"value":2182},{"type":43,"tag":207,"props":2874,"children":2875},{},[2876,2881],{"type":43,"tag":229,"props":2877,"children":2878},{},[2879],{"type":49,"value":2880},"Memory",{"type":43,"tag":229,"props":2882,"children":2883},{},[2884,2889,2890,2895,2896,2901,2902,2907,2908],{"type":43,"tag":66,"props":2885,"children":2887},{"className":2886},[],[2888],{"type":49,"value":1859},{"type":49,"value":105},{"type":43,"tag":66,"props":2891,"children":2893},{"className":2892},[],[2894],{"type":49,"value":2218},{"type":49,"value":105},{"type":43,"tag":66,"props":2897,"children":2899},{"className":2898},[],[2900],{"type":49,"value":2225},{"type":49,"value":105},{"type":43,"tag":66,"props":2903,"children":2905},{"className":2904},[],[2906],{"type":49,"value":2232},{"type":49,"value":105},{"type":43,"tag":66,"props":2909,"children":2911},{"className":2910},[],[2912],{"type":49,"value":2241},{"type":43,"tag":207,"props":2914,"children":2915},{},[2916,2921],{"type":43,"tag":229,"props":2917,"children":2918},{},[2919],{"type":49,"value":2920},"Model \u002F lifecycle",{"type":43,"tag":229,"props":2922,"children":2923},{},[2924,2929,2930,2935,2936,2941,2942],{"type":43,"tag":66,"props":2925,"children":2927},{"className":2926},[],[2928],{"type":49,"value":1803},{"type":49,"value":105},{"type":43,"tag":66,"props":2931,"children":2933},{"className":2932},[],[2934],{"type":49,"value":2735},{"type":49,"value":105},{"type":43,"tag":66,"props":2937,"children":2939},{"className":2938},[],[2940],{"type":49,"value":2706},{"type":49,"value":105},{"type":43,"tag":66,"props":2943,"children":2945},{"className":2944},[],[2946],{"type":49,"value":2947},"ad_create_job",{"type":43,"tag":207,"props":2949,"children":2950},{},[2951,2956],{"type":43,"tag":229,"props":2952,"children":2953},{},[2954],{"type":49,"value":2955},"CCS",{"type":43,"tag":229,"props":2957,"children":2958},{},[2959],{"type":43,"tag":66,"props":2960,"children":2962},{"className":2961},[],[2963],{"type":49,"value":2302},{"type":43,"tag":207,"props":2965,"children":2966},{},[2967,2972],{"type":43,"tag":229,"props":2968,"children":2969},{},[2970],{"type":49,"value":2971},"Calendars",{"type":43,"tag":229,"props":2973,"children":2974},{},[2975,2981,2982],{"type":43,"tag":66,"props":2976,"children":2978},{"className":2977},[],[2979],{"type":49,"value":2980},"ad_get_calendar_events",{"type":49,"value":105},{"type":43,"tag":66,"props":2983,"children":2985},{"className":2984},[],[2986],{"type":49,"value":2987},"ad_create_calendar_event",{"type":43,"tag":52,"props":2989,"children":2990},{},[2991,2993,2998],{"type":49,"value":2992},"Full parameter tables, ES|QL templates, and REST step lists:\n",{"type":43,"tag":161,"props":2994,"children":2996},{"href":2995},"references\u002Ftroubleshoot-anomaly-tool-reference.md",[2997],{"type":49,"value":2995},{"type":49,"value":192},{"type":43,"tag":744,"props":3000,"children":3002},{"id":3001},"rules-2",[3003],{"type":49,"value":1120},{"type":43,"tag":1122,"props":3005,"children":3006},{},[3007,3021,3049,3059,3069,3087],{"type":43,"tag":93,"props":3008,"children":3009},{},[3010,3019],{"type":43,"tag":58,"props":3011,"children":3012},{},[3013,3018],{"type":43,"tag":66,"props":3014,"children":3016},{"className":3015},[],[3017],{"type":49,"value":181},{"type":49,"value":183},{"type":49,"value":3020}," — missing privileges produce misleading empty results.",{"type":43,"tag":93,"props":3022,"children":3023},{},[3024,3034,3035,3040,3042,3047],{"type":43,"tag":58,"props":3025,"children":3026},{},[3027,3029],{"type":49,"value":3028},"Fix memory before ",{"type":43,"tag":66,"props":3030,"children":3032},{"className":3031},[],[3033],{"type":49,"value":2141},{"type":49,"value":1751},{"type":43,"tag":66,"props":3036,"children":3038},{"className":3037},[],[3039],{"type":49,"value":2203},{"type":49,"value":3041}," corrupts state; ",{"type":43,"tag":66,"props":3043,"children":3045},{"className":3044},[],[3046],{"type":49,"value":2141},{"type":49,"value":3048}," fixes on a memory-limited job are\nwasted.",{"type":43,"tag":93,"props":3050,"children":3051},{},[3052,3057],{"type":43,"tag":58,"props":3053,"children":3054},{},[3055],{"type":49,"value":3056},"Stop the datafeed before updating it.",{"type":49,"value":3058}," Updating a running datafeed is rejected.",{"type":43,"tag":93,"props":3060,"children":3061},{},[3062,3067],{"type":43,"tag":58,"props":3063,"children":3064},{},[3065],{"type":49,"value":3066},"Close the job before updating memory limit.",{"type":49,"value":3068}," Sequence above.",{"type":43,"tag":93,"props":3070,"children":3071},{},[3072,3085],{"type":43,"tag":58,"props":3073,"children":3074},{},[3075,3077,3083],{"type":49,"value":3076},"Prefer workflow tools (",{"type":43,"tag":66,"props":3078,"children":3080},{"className":3079},[],[3081],{"type":49,"value":3082},"ad_wf_*",{"type":49,"value":3084},") over manually chaining diagnostics",{"type":49,"value":3086}," for complex decisions.",{"type":43,"tag":93,"props":3088,"children":3089},{},[3090,3100],{"type":43,"tag":58,"props":3091,"children":3092},{},[3093,3098],{"type":43,"tag":66,"props":3094,"children":3096},{"className":3095},[],[3097],{"type":49,"value":2826},{"type":49,"value":3099}," before starting",{"type":49,"value":3101}," — confirm the datafeed returns data after config changes.",{"type":43,"tag":338,"props":3103,"children":3104},{},[],{"type":43,"tag":82,"props":3106,"children":3108},{"id":3107},"mode-manage-create-configure-jobs",[3109],{"type":49,"value":3110},"Mode: Manage — Create \u002F configure jobs",{"type":43,"tag":52,"props":3112,"children":3113},{},[3114,3118],{"type":43,"tag":58,"props":3115,"children":3116},{},[3117],{"type":49,"value":740},{"type":49,"value":3119}," \"set up a job\", \"create an ML detector\", \"monitor X over time\", \"detect rare\u002Funusual\u002Fanomalous values\".",{"type":43,"tag":744,"props":3121,"children":3123},{"id":3122},"_4-step-workflow",[3124],{"type":49,"value":3125},"4-step workflow",{"type":43,"tag":3127,"props":3128,"children":3133},"pre",{"className":3129,"code":3131,"language":49,"meta":3132},[3130],"language-text","PUT _ml\u002Fanomaly_detectors\u002F\u003Cjob_id> # 1. Define job (ad_create_job)\nPUT _ml\u002Fdatafeeds\u002Fdatafeed-\u003Cjob_id> # 2. Define datafeed (ad_create_datafeed)\nPOST _ml\u002Fanomaly_detectors\u002F\u003Cjob_id>\u002F_open # 3a. Open job (ad_open_job)\nPOST _ml\u002Fdatafeeds\u002Fdatafeed-\u003Cjob_id>\u002F_start # 3b. Start datafeed (ad_manage_datafeed action=_start)\nGET _ml\u002Fanomaly_detectors\u002F\u003Cjob_id>\u002Fresults\u002Frecords # 4. Read results\n","",[3134],{"type":43,"tag":66,"props":3135,"children":3136},{"__ignoreMap":3132},[3137],{"type":49,"value":3131},{"type":43,"tag":744,"props":3139,"children":3141},{"id":3140},"process",[3142],{"type":49,"value":3143},"Process",{"type":43,"tag":1122,"props":3145,"children":3146},{},[3147,3157,3363,3481,3506,3530],{"type":43,"tag":93,"props":3148,"children":3149},{},[3150,3155],{"type":43,"tag":58,"props":3151,"children":3152},{},[3153],{"type":49,"value":3154},"Build configs.",{"type":49,"value":3156}," Parse the user request into job + datafeed JSON with no null fields.",{"type":43,"tag":93,"props":3158,"children":3159},{},[3160,3165],{"type":43,"tag":58,"props":3161,"children":3162},{},[3163],{"type":49,"value":3164},"Apply smart defaults:",{"type":43,"tag":199,"props":3166,"children":3167},{},[3168,3188],{"type":43,"tag":203,"props":3169,"children":3170},{},[3171],{"type":43,"tag":207,"props":3172,"children":3173},{},[3174,3178,3183],{"type":43,"tag":211,"props":3175,"children":3176},{},[3177],{"type":49,"value":1243},{"type":43,"tag":211,"props":3179,"children":3180},{},[3181],{"type":49,"value":3182},"Default",{"type":43,"tag":211,"props":3184,"children":3185},{},[3186],{"type":49,"value":3187},"Override when",{"type":43,"tag":222,"props":3189,"children":3190},{},[3191,3216,3242,3268,3294,3316,3338],{"type":43,"tag":207,"props":3192,"children":3193},{},[3194,3202,3211],{"type":43,"tag":229,"props":3195,"children":3196},{},[3197],{"type":43,"tag":66,"props":3198,"children":3200},{"className":3199},[],[3201],{"type":49,"value":521},{"type":43,"tag":229,"props":3203,"children":3204},{},[3205],{"type":43,"tag":66,"props":3206,"children":3208},{"className":3207},[],[3209],{"type":49,"value":3210},"\"15m\"",{"type":43,"tag":229,"props":3212,"children":3213},{},[3214],{"type":49,"value":3215},"User specifies a different span",{"type":43,"tag":207,"props":3217,"children":3218},{},[3219,3228,3237],{"type":43,"tag":229,"props":3220,"children":3221},{},[3222],{"type":43,"tag":66,"props":3223,"children":3225},{"className":3224},[],[3226],{"type":49,"value":3227},"time_field",{"type":43,"tag":229,"props":3229,"children":3230},{},[3231],{"type":43,"tag":66,"props":3232,"children":3234},{"className":3233},[],[3235],{"type":49,"value":3236},"\"@timestamp\"",{"type":43,"tag":229,"props":3238,"children":3239},{},[3240],{"type":49,"value":3241},"User names a different timestamp field",{"type":43,"tag":207,"props":3243,"children":3244},{},[3245,3254,3263],{"type":43,"tag":229,"props":3246,"children":3247},{},[3248],{"type":43,"tag":66,"props":3249,"children":3251},{"className":3250},[],[3252],{"type":49,"value":3253},"index",{"type":43,"tag":229,"props":3255,"children":3256},{},[3257],{"type":43,"tag":66,"props":3258,"children":3260},{"className":3259},[],[3261],{"type":49,"value":3262},"\"logs-*\"",{"type":43,"tag":229,"props":3264,"children":3265},{},[3266],{"type":49,"value":3267},"User specifies an index or pattern",{"type":43,"tag":207,"props":3269,"children":3270},{},[3271,3280,3289],{"type":43,"tag":229,"props":3272,"children":3273},{},[3274],{"type":43,"tag":66,"props":3275,"children":3277},{"className":3276},[],[3278],{"type":49,"value":3279},"datafeed_query",{"type":43,"tag":229,"props":3281,"children":3282},{},[3283],{"type":43,"tag":66,"props":3284,"children":3286},{"className":3285},[],[3287],{"type":49,"value":3288},"{\"match_all\": {}}",{"type":43,"tag":229,"props":3290,"children":3291},{},[3292],{"type":49,"value":3293},"User mentions filters, processes, or time windows",{"type":43,"tag":207,"props":3295,"children":3296},{},[3297,3306,3311],{"type":43,"tag":229,"props":3298,"children":3299},{},[3300],{"type":43,"tag":66,"props":3301,"children":3303},{"className":3302},[],[3304],{"type":49,"value":3305},"influencers",{"type":43,"tag":229,"props":3307,"children":3308},{},[3309],{"type":49,"value":3310},"by\u002Fover\u002Fpartition fields from detectors",{"type":43,"tag":229,"props":3312,"children":3313},{},[3314],{"type":49,"value":3315},"User adds extra influencer fields",{"type":43,"tag":207,"props":3317,"children":3318},{},[3319,3328,3333],{"type":43,"tag":229,"props":3320,"children":3321},{},[3322],{"type":43,"tag":66,"props":3323,"children":3325},{"className":3324},[],[3326],{"type":49,"value":3327},"job_id",{"type":43,"tag":229,"props":3329,"children":3330},{},[3331],{"type":49,"value":3332},"Generated from user description",{"type":43,"tag":229,"props":3334,"children":3335},{},[3336],{"type":49,"value":3337},"User provides an explicit ID",{"type":43,"tag":207,"props":3339,"children":3340},{},[3341,3349,3358],{"type":43,"tag":229,"props":3342,"children":3343},{},[3344],{"type":43,"tag":66,"props":3345,"children":3347},{"className":3346},[],[3348],{"type":49,"value":2141},{"type":43,"tag":229,"props":3350,"children":3351},{},[3352],{"type":43,"tag":66,"props":3353,"children":3355},{"className":3354},[],[3356],{"type":49,"value":3357},"\"60s\"",{"type":43,"tag":229,"props":3359,"children":3360},{},[3361],{"type":49,"value":3362},"P95 ingest latency is higher",{"type":43,"tag":93,"props":3364,"children":3365},{},[3366,3371,3373,3377,3378,3423,3427,3432,3434],{"type":43,"tag":58,"props":3367,"children":3368},{},[3369],{"type":49,"value":3370},"Choose detector function",{"type":49,"value":3372}," from user intent — full table in\n",{"type":43,"tag":161,"props":3374,"children":3375},{"href":2073},[3376],{"type":49,"value":2073},{"type":49,"value":498},{"type":43,"tag":89,"props":3379,"children":3380},{},[3381,3399,3412],{"type":43,"tag":93,"props":3382,"children":3383},{},[3384,3386,3391,3393],{"type":49,"value":3385},"\"high CPU\" \u002F \"unusually large\" → ",{"type":43,"tag":66,"props":3387,"children":3389},{"className":3388},[],[3390],{"type":49,"value":1557},{"type":49,"value":3392}," or ",{"type":43,"tag":66,"props":3394,"children":3396},{"className":3395},[],[3397],{"type":49,"value":3398},"high_sum",{"type":43,"tag":93,"props":3400,"children":3401},{},[3402,3404,3410],{"type":49,"value":3403},"\"rare logins\" \u002F \"unusual values\" → ",{"type":43,"tag":66,"props":3405,"children":3407},{"className":3406},[],[3408],{"type":49,"value":3409},"rare",{"type":49,"value":3411}," (variants below)",{"type":43,"tag":93,"props":3413,"children":3414},{},[3415,3417],{"type":49,"value":3416},"\"too many requests\" \u002F \"spike in count\" → ",{"type":43,"tag":66,"props":3418,"children":3420},{"className":3419},[],[3421],{"type":49,"value":3422},"high_count",{"type":43,"tag":3424,"props":3425,"children":3426},"br",{},[],{"type":43,"tag":66,"props":3428,"children":3430},{"className":3429},[],[3431],{"type":49,"value":3409},{"type":49,"value":3433}," variants:",{"type":43,"tag":89,"props":3435,"children":3436},{},[3437,3448,3459,3470],{"type":43,"tag":93,"props":3438,"children":3439},{},[3440,3442],{"type":49,"value":3441},"Infrequent globally → ",{"type":43,"tag":66,"props":3443,"children":3445},{"className":3444},[],[3446],{"type":49,"value":3447},"rare by_field_name: X",{"type":43,"tag":93,"props":3449,"children":3450},{},[3451,3453],{"type":49,"value":3452},"Infrequent vs peers → ",{"type":43,"tag":66,"props":3454,"children":3456},{"className":3455},[],[3457],{"type":49,"value":3458},"rare by_field_name: X over_field_name: Y",{"type":43,"tag":93,"props":3460,"children":3461},{},[3462,3464],{"type":49,"value":3463},"Infrequent per segment → ",{"type":43,"tag":66,"props":3465,"children":3467},{"className":3466},[],[3468],{"type":49,"value":3469},"rare by_field_name: X partition_field_name: Y",{"type":43,"tag":93,"props":3471,"children":3472},{},[3473,3475],{"type":49,"value":3474},"Infrequent per segment vs peers → ",{"type":43,"tag":66,"props":3476,"children":3478},{"className":3477},[],[3479],{"type":49,"value":3480},"rare by_field_name: X over_field_name: Y partition_field_name: Z",{"type":43,"tag":93,"props":3482,"children":3483},{},[3484,3489,3490,3496,3498,3504],{"type":43,"tag":58,"props":3485,"children":3486},{},[3487],{"type":49,"value":3488},"Validate.",{"type":49,"value":1530},{"type":43,"tag":66,"props":3491,"children":3493},{"className":3492},[],[3494],{"type":49,"value":3495},"platform.core.get_index_mapping",{"type":49,"value":3497}," on the target index to verify field existence\u002Ftypes →\n",{"type":43,"tag":66,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":49,"value":3503},"ad_validate_job_spec",{"type":49,"value":3505},". If errors, fix and re-validate (max 3 attempts).",{"type":43,"tag":93,"props":3507,"children":3508},{},[3509,3514,3516,3521,3523,3528],{"type":43,"tag":58,"props":3510,"children":3511},{},[3512],{"type":49,"value":3513},"Present and confirm.",{"type":49,"value":3515}," Show the ",{"type":43,"tag":58,"props":3517,"children":3518},{},[3519],{"type":49,"value":3520},"complete",{"type":49,"value":3522}," job + datafeed bodies formatted as the exact API calls. Ask for\napproval ",{"type":43,"tag":58,"props":3524,"children":3525},{},[3526],{"type":49,"value":3527},"once",{"type":49,"value":3529},". If feedback, incorporate and re-present (up to 3 rounds).",{"type":43,"tag":93,"props":3531,"children":3532},{},[3533,3538,3540,3545,3546,3552,3553,3558,3559,3564,3566,3571,3573,3578,3579,3585],{"type":43,"tag":58,"props":3534,"children":3535},{},[3536],{"type":49,"value":3537},"Deploy.",{"type":49,"value":3539}," After confirmation: ",{"type":43,"tag":66,"props":3541,"children":3543},{"className":3542},[],[3544],{"type":49,"value":2947},{"type":49,"value":2153},{"type":43,"tag":66,"props":3547,"children":3549},{"className":3548},[],[3550],{"type":49,"value":3551},"ad_create_datafeed",{"type":49,"value":2153},{"type":43,"tag":66,"props":3554,"children":3556},{"className":3555},[],[3557],{"type":49,"value":2706},{"type":49,"value":2153},{"type":43,"tag":66,"props":3560,"children":3562},{"className":3561},[],[3563],{"type":49,"value":2272},{"type":49,"value":3565},"\n(",{"type":43,"tag":66,"props":3567,"children":3569},{"className":3568},[],[3570],{"type":49,"value":2723},{"type":49,"value":3572},"). Report final ",{"type":43,"tag":66,"props":3574,"children":3576},{"className":3575},[],[3577],{"type":49,"value":3327},{"type":49,"value":1990},{"type":43,"tag":66,"props":3580,"children":3582},{"className":3581},[],[3583],{"type":49,"value":3584},"datafeed_id",{"type":49,"value":192},{"type":43,"tag":52,"props":3587,"children":3588},{},[3589,3591,3596,3598,3604,3605,3611],{"type":49,"value":3590},"For ",{"type":43,"tag":58,"props":3592,"children":3593},{},[3594],{"type":49,"value":3595},"batch analysis on historical data",{"type":49,"value":3597},", pass ",{"type":43,"tag":66,"props":3599,"children":3601},{"className":3600},[],[3602],{"type":49,"value":3603},"start",{"type":49,"value":1990},{"type":43,"tag":66,"props":3606,"children":3608},{"className":3607},[],[3609],{"type":49,"value":3610},"end",{"type":49,"value":3612}," to the datafeed start call.",{"type":43,"tag":451,"props":3614,"children":3615},{},[3616],{"type":43,"tag":52,"props":3617,"children":3618},{},[3619,3621,3626],{"type":49,"value":3620},"Worked examples (rare-username, DNS exfil, large-downloads) with full JSON bodies and datafeed filters:\n",{"type":43,"tag":161,"props":3622,"children":3624},{"href":3623},"references\u002Fjob-creation-recipes.md",[3625],{"type":49,"value":3623},{"type":49,"value":192},{"type":43,"tag":744,"props":3628,"children":3630},{"id":3629},"rules-3",[3631],{"type":49,"value":1120},{"type":43,"tag":1122,"props":3633,"children":3634},{},[3635,3645,3655,3670,3687,3731],{"type":43,"tag":93,"props":3636,"children":3637},{},[3638,3643],{"type":43,"tag":58,"props":3639,"children":3640},{},[3641],{"type":49,"value":3642},"Create job before datafeed.",{"type":49,"value":3644}," Datafeed references job by ID.",{"type":43,"tag":93,"props":3646,"children":3647},{},[3648,3653],{"type":43,"tag":58,"props":3649,"children":3650},{},[3651],{"type":49,"value":3652},"Open job before starting datafeed.",{"type":49,"value":3654}," Start on a closed job is rejected.",{"type":43,"tag":93,"props":3656,"children":3657},{},[3658,3668],{"type":43,"tag":58,"props":3659,"children":3660},{},[3661,3666],{"type":43,"tag":66,"props":3662,"children":3664},{"className":3663},[],[3665],{"type":49,"value":2141},{"type":49,"value":3667}," = P95 ingest latency + buffer",{"type":49,"value":3669}," (60s–120s safe default).",{"type":43,"tag":93,"props":3671,"children":3672},{},[3673,3678,3679,3685],{"type":43,"tag":58,"props":3674,"children":3675},{},[3676],{"type":49,"value":3677},"Forecasts require non-population jobs",{"type":49,"value":1751},{"type":43,"tag":66,"props":3680,"children":3682},{"className":3681},[],[3683],{"type":49,"value":3684},"over_field_name",{"type":49,"value":3686}," jobs cannot be forecasted; warn before attempting.",{"type":43,"tag":93,"props":3688,"children":3689},{},[3690,3706,3707,3713,3715,3721,3723,3729],{"type":43,"tag":58,"props":3691,"children":3692},{},[3693,3699,3700,3705],{"type":43,"tag":66,"props":3694,"children":3696},{"className":3695},[],[3697],{"type":49,"value":3698},"by_field_name",{"type":49,"value":553},{"type":43,"tag":66,"props":3701,"children":3703},{"className":3702},[],[3704],{"type":49,"value":3684},{"type":49,"value":498},{"type":49,"value":1530},{"type":43,"tag":66,"props":3708,"children":3710},{"className":3709},[],[3711],{"type":49,"value":3712},"by",{"type":49,"value":3714}," compares entity to its own history; ",{"type":43,"tag":66,"props":3716,"children":3718},{"className":3717},[],[3719],{"type":49,"value":3720},"over",{"type":49,"value":3722}," compares to peer group in\nthe same bucket. ",{"type":43,"tag":66,"props":3724,"children":3726},{"className":3725},[],[3727],{"type":49,"value":3728},"partition_field_name",{"type":49,"value":3730}," = fully independent sub-model with its own normalization.",{"type":43,"tag":93,"props":3732,"children":3733},{},[3734,3744],{"type":43,"tag":58,"props":3735,"children":3736},{},[3737,3742],{"type":43,"tag":66,"props":3738,"children":3740},{"className":3739},[],[3741],{"type":49,"value":521},{"type":49,"value":3743}," matches detection granularity",{"type":49,"value":3745}," — 15m for high-frequency, 1h for operational metrics, 1d for daily\npatterns. Larger smooths short spikes; smaller increases noise.",{"type":43,"tag":338,"props":3747,"children":3748},{},[],{"type":43,"tag":82,"props":3750,"children":3752},{"id":3751},"registration-kibana-agent-builder",[3753],{"type":49,"value":3754},"Registration (Kibana Agent Builder)",{"type":43,"tag":52,"props":3756,"children":3757},{},[3758,3760,3765,3766,3772],{"type":49,"value":3759},"Requires Node.js 18+. Defaults to ",{"type":43,"tag":66,"props":3761,"children":3763},{"className":3762},[],[3764],{"type":49,"value":8},{"type":49,"value":429},{"type":43,"tag":66,"props":3767,"children":3769},{"className":3768},[],[3770],{"type":49,"value":3771},"changeme",{"type":49,"value":3773}," when no credentials are supplied.",{"type":43,"tag":3127,"props":3775,"children":3779},{"className":3776,"code":3777,"language":3778,"meta":3132,"style":3132},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cd skills\u002Fkibana\u002Fkibana-anomaly-detection\n\n# tools → workflows → skills\nnode scripts\u002Fkibana-agent-builder.mjs all register --kibana-url http:\u002F\u002Flocalhost:5601\n\n# HTTPS with self-signed cert\nnode scripts\u002Fkibana-agent-builder.mjs all register --kibana-url https:\u002F\u002Flocalhost:5601 --insecure\n","bash",[3780],{"type":43,"tag":66,"props":3781,"children":3782},{"__ignoreMap":3132},[3783,3801,3811,3821,3856,3864,3873],{"type":43,"tag":3784,"props":3785,"children":3788},"span",{"class":3786,"line":3787},"line",1,[3789,3795],{"type":43,"tag":3784,"props":3790,"children":3792},{"style":3791},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[3793],{"type":49,"value":3794},"cd",{"type":43,"tag":3784,"props":3796,"children":3798},{"style":3797},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[3799],{"type":49,"value":3800}," skills\u002Fkibana\u002Fkibana-anomaly-detection\n",{"type":43,"tag":3784,"props":3802,"children":3804},{"class":3786,"line":3803},2,[3805],{"type":43,"tag":3784,"props":3806,"children":3808},{"emptyLinePlaceholder":3807},true,[3809],{"type":49,"value":3810},"\n",{"type":43,"tag":3784,"props":3812,"children":3814},{"class":3786,"line":3813},3,[3815],{"type":43,"tag":3784,"props":3816,"children":3818},{"style":3817},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[3819],{"type":49,"value":3820},"# tools → workflows → skills\n",{"type":43,"tag":3784,"props":3822,"children":3824},{"class":3786,"line":3823},4,[3825,3831,3836,3841,3846,3851],{"type":43,"tag":3784,"props":3826,"children":3828},{"style":3827},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[3829],{"type":49,"value":3830},"node",{"type":43,"tag":3784,"props":3832,"children":3833},{"style":3797},[3834],{"type":49,"value":3835}," scripts\u002Fkibana-agent-builder.mjs",{"type":43,"tag":3784,"props":3837,"children":3838},{"style":3797},[3839],{"type":49,"value":3840}," all",{"type":43,"tag":3784,"props":3842,"children":3843},{"style":3797},[3844],{"type":49,"value":3845}," register",{"type":43,"tag":3784,"props":3847,"children":3848},{"style":3797},[3849],{"type":49,"value":3850}," --kibana-url",{"type":43,"tag":3784,"props":3852,"children":3853},{"style":3797},[3854],{"type":49,"value":3855}," http:\u002F\u002Flocalhost:5601\n",{"type":43,"tag":3784,"props":3857,"children":3859},{"class":3786,"line":3858},5,[3860],{"type":43,"tag":3784,"props":3861,"children":3862},{"emptyLinePlaceholder":3807},[3863],{"type":49,"value":3810},{"type":43,"tag":3784,"props":3865,"children":3867},{"class":3786,"line":3866},6,[3868],{"type":43,"tag":3784,"props":3869,"children":3870},{"style":3817},[3871],{"type":49,"value":3872},"# HTTPS with self-signed cert\n",{"type":43,"tag":3784,"props":3874,"children":3876},{"class":3786,"line":3875},7,[3877,3881,3885,3889,3893,3897,3902],{"type":43,"tag":3784,"props":3878,"children":3879},{"style":3827},[3880],{"type":49,"value":3830},{"type":43,"tag":3784,"props":3882,"children":3883},{"style":3797},[3884],{"type":49,"value":3835},{"type":43,"tag":3784,"props":3886,"children":3887},{"style":3797},[3888],{"type":49,"value":3840},{"type":43,"tag":3784,"props":3890,"children":3891},{"style":3797},[3892],{"type":49,"value":3845},{"type":43,"tag":3784,"props":3894,"children":3895},{"style":3797},[3896],{"type":49,"value":3850},{"type":43,"tag":3784,"props":3898,"children":3899},{"style":3797},[3900],{"type":49,"value":3901}," https:\u002F\u002Flocalhost:5601",{"type":43,"tag":3784,"props":3903,"children":3904},{"style":3797},[3905],{"type":49,"value":3906}," --insecure\n",{"type":43,"tag":52,"props":3908,"children":3909},{},[3910,3916,3918,3924,3926,3932,3933,3939,3941,3946,3952,3954,3960,3962,3968,3970,3975,3977,3982],{"type":43,"tag":66,"props":3911,"children":3913},{"className":3912},[],[3914],{"type":49,"value":3915},"all register",{"type":49,"value":3917}," runs ",{"type":43,"tag":66,"props":3919,"children":3921},{"className":3920},[],[3922],{"type":49,"value":3923},"tools register",{"type":49,"value":3925},", then ",{"type":43,"tag":66,"props":3927,"children":3929},{"className":3928},[],[3930],{"type":49,"value":3931},"workflows register",{"type":49,"value":3925},{"type":43,"tag":66,"props":3934,"children":3936},{"className":3935},[],[3937],{"type":49,"value":3938},"skills register",{"type":49,"value":3940},". Kibana allows ",{"type":43,"tag":58,"props":3942,"children":3943},{},[3944],{"type":49,"value":3945},"at most five",{"type":43,"tag":66,"props":3947,"children":3949},{"className":3948},[],[3950],{"type":49,"value":3951},"tool_ids",{"type":49,"value":3953}," per skill; the script fills them by scanning ",{"type":43,"tag":66,"props":3955,"children":3957},{"className":3956},[],[3958],{"type":49,"value":3959},"SKILL.md",{"type":49,"value":3961}," for tool mentions (in document order), then appends\nids from ",{"type":43,"tag":66,"props":3963,"children":3965},{"className":3964},[],[3966],{"type":49,"value":3967},"references\u002Fkibana\u002Ftools\u002Fesql\u002F*.json",{"type":49,"value":3969}," until the cap (workflow-only tools omitted by default). If you run\n",{"type":43,"tag":66,"props":3971,"children":3973},{"className":3972},[],[3974],{"type":49,"value":3938},{"type":49,"value":3976}," alone, run ",{"type":43,"tag":66,"props":3978,"children":3980},{"className":3979},[],[3981],{"type":49,"value":3923},{"type":49,"value":3983}," first so those ids exist.",{"type":43,"tag":52,"props":3985,"children":3986},{},[3987,3989,3994],{"type":49,"value":3988},"Workflow tool exclusions and prefixes live in ",{"type":43,"tag":66,"props":3990,"children":3992},{"className":3991},[],[3993],{"type":49,"value":144},{"type":49,"value":192},{"type":43,"tag":52,"props":3996,"children":3997},{},[3998],{"type":43,"tag":58,"props":3999,"children":4000},{},[4001],{"type":49,"value":4002},"MCP API key permissions:",{"type":43,"tag":89,"props":4004,"children":4005},{},[4006,4024,4067],{"type":43,"tag":93,"props":4007,"children":4008},{},[4009,4011,4017,4018],{"type":49,"value":4010},"Kibana: ",{"type":43,"tag":66,"props":4012,"children":4014},{"className":4013},[],[4015],{"type":49,"value":4016},"read_onechat",{"type":49,"value":105},{"type":43,"tag":66,"props":4019,"children":4021},{"className":4020},[],[4022],{"type":49,"value":4023},"space_read",{"type":43,"tag":93,"props":4025,"children":4026},{},[4027,4029,4035,4036,4042,4044,4049,4050,4055,4056,4061,4062],{"type":49,"value":4028},"Index: ",{"type":43,"tag":66,"props":4030,"children":4032},{"className":4031},[],[4033],{"type":49,"value":4034},"read",{"type":49,"value":105},{"type":43,"tag":66,"props":4037,"children":4039},{"className":4038},[],[4040],{"type":49,"value":4041},"view_index_metadata",{"type":49,"value":4043}," on ",{"type":43,"tag":66,"props":4045,"children":4047},{"className":4046},[],[4048],{"type":49,"value":103},{"type":49,"value":105},{"type":43,"tag":66,"props":4051,"children":4053},{"className":4052},[],[4054],{"type":49,"value":125},{"type":49,"value":105},{"type":43,"tag":66,"props":4057,"children":4059},{"className":4058},[],[4060],{"type":49,"value":118},{"type":49,"value":105},{"type":43,"tag":66,"props":4063,"children":4065},{"className":4064},[],[4066],{"type":49,"value":111},{"type":43,"tag":93,"props":4068,"children":4069},{},[4070,4072,4077],{"type":49,"value":4071},"For source evidence: ",{"type":43,"tag":66,"props":4073,"children":4075},{"className":4074},[],[4076],{"type":49,"value":4034},{"type":49,"value":4078}," on source data indices",{"type":43,"tag":338,"props":4080,"children":4081},{},[],{"type":43,"tag":82,"props":4083,"children":4085},{"id":4084},"tool-inventory",[4086],{"type":49,"value":4087},"Tool inventory",{"type":43,"tag":52,"props":4089,"children":4090},{},[4091,4093,4098,4100,4106,4108,4113,4115,4120],{"type":49,"value":4092},"ES|QL tool specs live under ",{"type":43,"tag":66,"props":4094,"children":4096},{"className":4095},[],[4097],{"type":49,"value":3967},{"type":49,"value":4099},"; workflow definitions under\n",{"type":43,"tag":66,"props":4101,"children":4103},{"className":4102},[],[4104],{"type":49,"value":4105},"references\u002Fkibana\u002Fworkflows\u002F*.yaml",{"type":49,"value":4107},". Each Mode section above lists the tools it uses. Full surface:\n",{"type":43,"tag":161,"props":4109,"children":4111},{"href":4110},"references\u002Ftools.md",[4112],{"type":49,"value":4110},{"type":49,"value":4114}," (ES|QL) and ",{"type":43,"tag":161,"props":4116,"children":4118},{"href":4117},"references\u002Fworkflow-tools.md",[4119],{"type":49,"value":4117},{"type":49,"value":4121},"\n(workflows).",{"type":43,"tag":744,"props":4123,"children":4125},{"id":4124},"key-system-indices",[4126],{"type":49,"value":4127},"Key system indices",{"type":43,"tag":199,"props":4129,"children":4130},{},[4131,4147],{"type":43,"tag":203,"props":4132,"children":4133},{},[4134],{"type":43,"tag":207,"props":4135,"children":4136},{},[4137,4142],{"type":43,"tag":211,"props":4138,"children":4139},{},[4140],{"type":49,"value":4141},"Index",{"type":43,"tag":211,"props":4143,"children":4144},{},[4145],{"type":49,"value":4146},"Relevant content",{"type":43,"tag":222,"props":4148,"children":4149},{},[4150,4216,4232,4255],{"type":43,"tag":207,"props":4151,"children":4152},{},[4153,4161],{"type":43,"tag":229,"props":4154,"children":4155},{},[4156],{"type":43,"tag":66,"props":4157,"children":4159},{"className":4158},[],[4160],{"type":49,"value":103},{"type":43,"tag":229,"props":4162,"children":4163},{},[4164,4169,4170,4175,4176,4181,4182,4188,4189,4195,4196,4202,4203,4209,4210],{"type":43,"tag":66,"props":4165,"children":4167},{"className":4166},[],[4168],{"type":49,"value":543},{"type":49,"value":105},{"type":43,"tag":66,"props":4171,"children":4173},{"className":4172},[],[4174],{"type":49,"value":513},{"type":49,"value":105},{"type":43,"tag":66,"props":4177,"children":4179},{"className":4178},[],[4180],{"type":49,"value":592},{"type":49,"value":105},{"type":43,"tag":66,"props":4183,"children":4185},{"className":4184},[],[4186],{"type":49,"value":4187},"model_plot",{"type":49,"value":105},{"type":43,"tag":66,"props":4190,"children":4192},{"className":4191},[],[4193],{"type":49,"value":4194},"model_forecast",{"type":49,"value":105},{"type":43,"tag":66,"props":4197,"children":4199},{"className":4198},[],[4200],{"type":49,"value":4201},"model_snapshot",{"type":49,"value":105},{"type":43,"tag":66,"props":4204,"children":4206},{"className":4205},[],[4207],{"type":49,"value":4208},"category_definition",{"type":49,"value":105},{"type":43,"tag":66,"props":4211,"children":4213},{"className":4212},[],[4214],{"type":49,"value":4215},"model_size_stats",{"type":43,"tag":207,"props":4217,"children":4218},{},[4219,4227],{"type":43,"tag":229,"props":4220,"children":4221},{},[4222],{"type":43,"tag":66,"props":4223,"children":4225},{"className":4224},[],[4226],{"type":49,"value":111},{"type":43,"tag":229,"props":4228,"children":4229},{},[4230],{"type":49,"value":4231},"job\u002Fdatafeed documents (visible even for never-run jobs)",{"type":43,"tag":207,"props":4233,"children":4234},{},[4235,4243],{"type":43,"tag":229,"props":4236,"children":4237},{},[4238],{"type":43,"tag":66,"props":4239,"children":4241},{"className":4240},[],[4242],{"type":49,"value":125},{"type":43,"tag":229,"props":4244,"children":4245},{},[4246,4248,4254],{"type":49,"value":4247},"delayed data (",{"type":43,"tag":66,"props":4249,"children":4251},{"className":4250},[],[4252],{"type":49,"value":4253},"event == \"delayed_data\"",{"type":49,"value":146},{"type":43,"tag":207,"props":4256,"children":4257},{},[4258,4266],{"type":43,"tag":229,"props":4259,"children":4260},{},[4261],{"type":43,"tag":66,"props":4262,"children":4264},{"className":4263},[],[4265],{"type":49,"value":118},{"type":43,"tag":229,"props":4267,"children":4268},{},[4269,4271,4277],{"type":49,"value":4270},"job messages (",{"type":43,"tag":66,"props":4272,"children":4274},{"className":4273},[],[4275],{"type":49,"value":4276},"level",{"type":49,"value":4278},": info\u002Fwarning\u002Ferror)",{"type":43,"tag":338,"props":4280,"children":4281},{},[],{"type":43,"tag":82,"props":4283,"children":4285},{"id":4284},"examples",[4286],{"type":49,"value":4287},"Examples",{"type":43,"tag":52,"props":4289,"children":4290},{},[4291,4296,4298,4303,4304,4309,4310,4315,4316,4321],{"type":43,"tag":58,"props":4292,"children":4293},{},[4294],{"type":49,"value":4295},"RCA:",{"type":49,"value":4297}," \"Something caused a spike in our error rate at 2pm — what broke?\" → Investigate → ",{"type":43,"tag":66,"props":4299,"children":4301},{"className":4300},[],[4302],{"type":49,"value":788},{"type":49,"value":995},{"type":43,"tag":66,"props":4305,"children":4307},{"className":4306},[],[4308],{"type":49,"value":826},{"type":49,"value":2153},{"type":43,"tag":66,"props":4311,"children":4313},{"className":4312},[],[4314],{"type":49,"value":843},{"type":49,"value":2153},{"type":43,"tag":66,"props":4317,"children":4319},{"className":4318},[],[4320],{"type":49,"value":850},{"type":49,"value":4322}," → RCA report.",{"type":43,"tag":52,"props":4324,"children":4325},{},[4326,4331,4333,4338,4340,4346],{"type":43,"tag":58,"props":4327,"children":4328},{},[4329],{"type":49,"value":4330},"Score drop:",{"type":49,"value":4332}," \"My anomaly score went from 90 to 55 — did the model change?\" → Explain → ",{"type":43,"tag":66,"props":4334,"children":4336},{"className":4335},[],[4337],{"type":49,"value":919},{"type":49,"value":4339},"\nfor drift → explain renormalization if ",{"type":43,"tag":66,"props":4341,"children":4343},{"className":4342},[],[4344],{"type":49,"value":4345},"score_drift",{"type":49,"value":4347}," is large.",{"type":43,"tag":52,"props":4349,"children":4350},{},[4351,4356,4358,4363,4365,4370,4371,4376,4377,4382,4383,4388],{"type":43,"tag":58,"props":4352,"children":4353},{},[4354],{"type":49,"value":4355},"Memory limit:",{"type":49,"value":4357}," \"Job status shows ",{"type":43,"tag":66,"props":4359,"children":4361},{"className":4360},[],[4362],{"type":49,"value":2203},{"type":49,"value":4364}," and results look wrong.\" → Troubleshoot → ",{"type":43,"tag":66,"props":4366,"children":4368},{"className":4367},[],[4369],{"type":49,"value":1859},{"type":49,"value":995},{"type":43,"tag":66,"props":4372,"children":4374},{"className":4373},[],[4375],{"type":49,"value":2218},{"type":49,"value":2153},{"type":43,"tag":66,"props":4378,"children":4380},{"className":4379},[],[4381],{"type":49,"value":2225},{"type":49,"value":2153},{"type":43,"tag":66,"props":4384,"children":4386},{"className":4385},[],[4387],{"type":49,"value":2232},{"type":49,"value":4389}," (lifecycle: stop\ndatafeed → close → update → open → start).",{"type":43,"tag":52,"props":4391,"children":4392},{},[4393,4398,4400,4405,4407,4413],{"type":43,"tag":58,"props":4394,"children":4395},{},[4396],{"type":49,"value":4397},"New job:",{"type":49,"value":4399}," \"Detect unusual error rates per host on nginx access logs.\" → Manage → ",{"type":43,"tag":66,"props":4401,"children":4403},{"className":4402},[],[4404],{"type":49,"value":3422},{"type":49,"value":4406}," detector with\n",{"type":43,"tag":66,"props":4408,"children":4410},{"className":4409},[],[4411],{"type":49,"value":4412},"by_field_name: \"host.keyword\"",{"type":49,"value":4414}," → validate → present → deploy.",{"type":43,"tag":52,"props":4416,"children":4417},{},[4418,4423,4425,4430],{"type":43,"tag":58,"props":4419,"children":4420},{},[4421],{"type":49,"value":4422},"Multi-mode:",{"type":49,"value":4424}," \"We had an incident last night, scores were high but now low — is the job healthy?\" → Investigate the\nincident → Explain the score drift → Troubleshoot if ",{"type":43,"tag":66,"props":4426,"children":4428},{"className":4427},[],[4429],{"type":49,"value":2203},{"type":49,"value":4431}," or delayed data is suspected.",{"type":43,"tag":338,"props":4433,"children":4434},{},[],{"type":43,"tag":82,"props":4436,"children":4438},{"id":4437},"guidelines",[4439],{"type":49,"value":4440},"Guidelines",{"type":43,"tag":1122,"props":4442,"children":4443},{},[4444,4454,4468,4506,4528,4550,4571,4581],{"type":43,"tag":93,"props":4445,"children":4446},{},[4447,4452],{"type":43,"tag":58,"props":4448,"children":4449},{},[4450],{"type":49,"value":4451},"Pick a mode first.",{"type":49,"value":4453}," Don't blend RCA logic with score-explanation logic in one response.",{"type":43,"tag":93,"props":4455,"children":4456},{},[4457,4466],{"type":43,"tag":58,"props":4458,"children":4459},{},[4460,4465],{"type":43,"tag":66,"props":4461,"children":4463},{"className":4462},[],[4464],{"type":49,"value":181},{"type":49,"value":183},{"type":49,"value":4467}," on empty results — privileges are the most common false-negative cause.",{"type":43,"tag":93,"props":4469,"children":4470},{},[4471,4476,4478,4483,4485,4490,4492,4497,4499,4504],{"type":43,"tag":58,"props":4472,"children":4473},{},[4474],{"type":49,"value":4475},"Score bands are absolute thresholds",{"type":49,"value":4477},": ",{"type":43,"tag":66,"props":4479,"children":4481},{"className":4480},[],[4482],{"type":49,"value":365},{"type":49,"value":4484}," critical, ",{"type":43,"tag":66,"props":4486,"children":4488},{"className":4487},[],[4489],{"type":49,"value":372},{"type":49,"value":4491}," warning, ",{"type":43,"tag":66,"props":4493,"children":4495},{"className":4494},[],[4496],{"type":49,"value":379},{"type":49,"value":4498}," minor, ",{"type":43,"tag":66,"props":4500,"children":4502},{"className":4501},[],[4503],{"type":49,"value":386},{"type":49,"value":4505}," informational.",{"type":43,"tag":93,"props":4507,"children":4508},{},[4509,4514,4515,4520,4522,4527],{"type":43,"tag":58,"props":4510,"children":4511},{},[4512],{"type":49,"value":4513},"Multi-job entities are prime suspects.",{"type":49,"value":1134},{"type":43,"tag":66,"props":4516,"children":4518},{"className":4517},[],[4519],{"type":49,"value":1015},{"type":49,"value":4521}," in ",{"type":43,"tag":66,"props":4523,"children":4525},{"className":4524},[],[4526],{"type":49,"value":850},{"type":49,"value":192},{"type":43,"tag":93,"props":4529,"children":4530},{},[4531,4548],{"type":43,"tag":58,"props":4532,"children":4533},{},[4534,4536,4541,4543],{"type":49,"value":4535},"Show ",{"type":43,"tag":66,"props":4537,"children":4539},{"className":4538},[],[4540],{"type":49,"value":650},{"type":49,"value":4542}," alongside ",{"type":43,"tag":66,"props":4544,"children":4546},{"className":4545},[],[4547],{"type":49,"value":358},{"type":49,"value":4549}," — the gap tells the renormalization story.",{"type":43,"tag":93,"props":4551,"children":4552},{},[4553,4563,4564,4569],{"type":43,"tag":58,"props":4554,"children":4555},{},[4556,4557,4562],{"type":49,"value":3028},{"type":43,"tag":66,"props":4558,"children":4560},{"className":4559},[],[4561],{"type":49,"value":2141},{"type":49,"value":192},{"type":49,"value":1530},{"type":43,"tag":66,"props":4565,"children":4567},{"className":4566},[],[4568],{"type":49,"value":2203},{"type":49,"value":4570}," invalidates downstream diagnostics.",{"type":43,"tag":93,"props":4572,"children":4573},{},[4574,4579],{"type":43,"tag":58,"props":4575,"children":4576},{},[4577],{"type":49,"value":4578},"Stop datafeed → close job → update config → open job → start datafeed",{"type":49,"value":4580}," for any config change to memory or query\ndelay.",{"type":43,"tag":93,"props":4582,"children":4583},{},[4584,4595],{"type":43,"tag":58,"props":4585,"children":4586},{},[4587,4589,4594],{"type":49,"value":4588},"Confirm RCAs with ",{"type":43,"tag":66,"props":4590,"children":4592},{"className":4591},[],[4593],{"type":49,"value":943},{"type":49,"value":192},{"type":49,"value":4596}," Raw source documents are ground truth.",{"type":43,"tag":4598,"props":4599,"children":4600},"style",{},[4601],{"type":49,"value":4602},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4604,"total":4699},[4605,4622,4636,4646,4661,4673,4688],{"slug":4606,"name":4606,"fn":4607,"description":4608,"org":4609,"tags":4610,"stars":23,"repoUrl":24,"updatedAt":4621},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4611,4614,4615,4618],{"name":4612,"slug":4613,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":4616,"slug":4617,"type":15},"Operations","operations",{"name":4619,"slug":4620,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":4623,"name":4623,"fn":4624,"description":4625,"org":4626,"tags":4627,"stars":23,"repoUrl":24,"updatedAt":4635},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4628,4629,4632],{"name":4612,"slug":4613,"type":15},{"name":4630,"slug":4631,"type":15},"Deployment","deployment",{"name":4633,"slug":4634,"type":15},"Elasticsearch","elasticsearch","2026-07-12T07:46:42.353362",{"slug":4637,"name":4637,"fn":4638,"description":4639,"org":4640,"tags":4641,"stars":23,"repoUrl":24,"updatedAt":4645},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4642,4643,4644],{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4616,"slug":4617,"type":15},"2026-07-12T07:46:41.097412",{"slug":4647,"name":4647,"fn":4648,"description":4649,"org":4650,"tags":4651,"stars":23,"repoUrl":24,"updatedAt":4660},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4652,4653,4654,4657],{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4655,"slug":4656,"type":15},"Networking","networking",{"name":4658,"slug":4659,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":4662,"name":4662,"fn":4663,"description":4664,"org":4665,"tags":4666,"stars":23,"repoUrl":24,"updatedAt":4672},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4667,4670,4671],{"name":4668,"slug":4669,"type":15},"Authentication","authentication",{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},"2026-07-12T07:46:39.783105",{"slug":4674,"name":4674,"fn":4675,"description":4676,"org":4677,"tags":4678,"stars":23,"repoUrl":24,"updatedAt":4687},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4679,4682,4683,4686],{"name":4680,"slug":4681,"type":15},"Audit","audit",{"name":4633,"slug":4634,"type":15},{"name":4684,"slug":4685,"type":15},"Logs","logs",{"name":4658,"slug":4659,"type":15},"2026-07-12T07:47:35.092599",{"slug":4689,"name":4689,"fn":4690,"description":4691,"org":4692,"tags":4693,"stars":23,"repoUrl":24,"updatedAt":4698},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4694,4695,4696,4697],{"name":4668,"slug":4669,"type":15},{"name":9,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4658,"slug":4659,"type":15},"2026-07-12T07:47:41.474547",35,{"items":4701,"total":4823},[4702,4721,4738,4751,4758,4764,4770,4777,4783,4790,4797,4810],{"slug":4703,"name":4703,"fn":4704,"description":4705,"org":4706,"tags":4707,"stars":4718,"repoUrl":4719,"updatedAt":4720},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4708,4711,4714,4715],{"name":4709,"slug":4710,"type":15},"Analytics","analytics",{"name":4712,"slug":4713,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":4716,"slug":4717,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":4722,"name":4722,"fn":4723,"description":4724,"org":4725,"tags":4726,"stars":4718,"repoUrl":4719,"updatedAt":4737},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4727,4730,4731,4734],{"name":4728,"slug":4729,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":4732,"slug":4733,"type":15},"Engineering","engineering",{"name":4735,"slug":4736,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":4739,"name":4739,"fn":4740,"description":4741,"org":4742,"tags":4743,"stars":4718,"repoUrl":4719,"updatedAt":4750},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4744,4745,4746,4747],{"name":9,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4716,"slug":4717,"type":15},{"name":4748,"slug":4749,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":4606,"name":4606,"fn":4607,"description":4608,"org":4752,"tags":4753,"stars":23,"repoUrl":24,"updatedAt":4621},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4754,4755,4756,4757],{"name":4612,"slug":4613,"type":15},{"name":9,"slug":8,"type":15},{"name":4616,"slug":4617,"type":15},{"name":4619,"slug":4620,"type":15},{"slug":4623,"name":4623,"fn":4624,"description":4625,"org":4759,"tags":4760,"stars":23,"repoUrl":24,"updatedAt":4635},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4761,4762,4763],{"name":4612,"slug":4613,"type":15},{"name":4630,"slug":4631,"type":15},{"name":4633,"slug":4634,"type":15},{"slug":4637,"name":4637,"fn":4638,"description":4639,"org":4765,"tags":4766,"stars":23,"repoUrl":24,"updatedAt":4645},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4767,4768,4769],{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4616,"slug":4617,"type":15},{"slug":4647,"name":4647,"fn":4648,"description":4649,"org":4771,"tags":4772,"stars":23,"repoUrl":24,"updatedAt":4660},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4773,4774,4775,4776],{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4655,"slug":4656,"type":15},{"name":4658,"slug":4659,"type":15},{"slug":4662,"name":4662,"fn":4663,"description":4664,"org":4778,"tags":4779,"stars":23,"repoUrl":24,"updatedAt":4672},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4780,4781,4782],{"name":4668,"slug":4669,"type":15},{"name":4612,"slug":4613,"type":15},{"name":4633,"slug":4634,"type":15},{"slug":4674,"name":4674,"fn":4675,"description":4676,"org":4784,"tags":4785,"stars":23,"repoUrl":24,"updatedAt":4687},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4786,4787,4788,4789],{"name":4680,"slug":4681,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4684,"slug":4685,"type":15},{"name":4658,"slug":4659,"type":15},{"slug":4689,"name":4689,"fn":4690,"description":4691,"org":4791,"tags":4792,"stars":23,"repoUrl":24,"updatedAt":4698},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4793,4794,4795,4796],{"name":4668,"slug":4669,"type":15},{"name":9,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4658,"slug":4659,"type":15},{"slug":4798,"name":4798,"fn":4799,"description":4800,"org":4801,"tags":4802,"stars":23,"repoUrl":24,"updatedAt":4809},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4803,4804,4805,4808],{"name":9,"slug":8,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4806,"slug":4807,"type":15},"RBAC","rbac",{"name":4658,"slug":4659,"type":15},"2026-07-12T07:47:36.394177",{"slug":4811,"name":4811,"fn":4812,"description":4813,"org":4814,"tags":4815,"stars":23,"repoUrl":24,"updatedAt":4822},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4816,4817,4818,4819],{"name":4709,"slug":4710,"type":15},{"name":4712,"slug":4713,"type":15},{"name":4633,"slug":4634,"type":15},{"name":4820,"slug":4821,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]