Open Distro for Elasticsearch Anomaly Detection

The Open Distro for Elasticsearch Anomaly Detection plugin enables you to leverage Machine Learning based algorithms to automatically detect anomalies as your log data is ingested. Combined with Alerting, you can monitor your data in near real time and automatically send alert notifications . With an intuitive Kibana interface and a powerful API, it is easy to set up, tune, and monitor your anomaly detectors.

Highlights

Anomaly detection is using Random Cut Forest (RCF) algorithm for detecting anomalous data points.

You should use anomaly detection kibana plugin with Open Distro Alerting kibana plugin 1.2-alpha. You can also create monitor based on anomaly detector. Scheduled monitor run will trigger anomaly detector and get anomaly result to check if should trigger alert or not based on custom trigger conditions.

Current Limitations

• This is alpha code.
• We inherit security features from Open Distro for Elasticsearch Alerting.
• We use Alerting alpha code branch.
• We will continuously add new unit test cases, but we don't have 100% unit test coverage for now. This is a great area for developers from the community to contribute and help improve test coverage.
• Please see documentation links and GitHub issues for other details.

Documentation

Please see our documentation.

Setup

1. Download Elasticsearch for the version that matches the Kibana version specified in package.json.

2. Download and install the appropriate Open Distro for Elasticsearch Anomaly Detection Kibana plugin.

3. Download the Kibana source code for the version specified in package.json you want to set up.

   See the Kibana contributing guide for more instructions on setting up your development environment.

4. Change your node version to the version specified in .node-version inside the Kibana root directory.

5. Create a plugins directory inside the Kibana source code directory, if plugins directory doesn't exist.

6. Check out this package from version control into the plugins directory.

7. Run yarn kbn bootstrap inside kibana/plugins/anomaly-detection-kibana-plugin.

Ultimately, your directory structure should look like this:

.
├── kibana
│   └──plugins
│      └── anomaly-detection-kibana-plugin

Build

To build the plugin's distributable zip simply run yarn build.

Example output: ./build/opendistro-anomaly-detection-1.4.2.0.zip

Run

• yarn start

  Starts Kibana and includes this plugin. Kibana will be available on localhost:5601.

• NODE_PATH=../../node_modules yarn test:jest

  Runs the plugin tests.

Contributing to Open Distro for Elasticsearch Anomaly detection Kibana

We welcome you to get involved in development, documentation, testing the anomaly detection plugin. See our CONTRIBUTING.md and join in.

Since this is a Kibana plugin, it can be useful to review the Kibana contributing guide alongside the documentation around Kibana plugins and plugin development.

Code of Conduct

This project has adopted an Open Source Code of Conduct.

Security issue notifications

If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our vulnerability reporting page. Please do not create a public GitHub issue.

License

See the LICENSE file for our project's licensing. We will ask you to confirm the licensing of your contribution.

Copyright

Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.