APM anomaly detection configurations

edit

These anomaly detection job wizards appear in Kibana if you have data from APM Agents or an APM Server stored in Elasticsearch. For more details, see the datafeed and job definitions in the apm_* folders in GitHub.

NodeJS

edit

Detect abnormal traces, anomalous spans, and identify periods of decreased throughput. These configurations are only available if data exists that matches the recognizer query specified in the mainfest file.

abnormal_span_durations_nodejs
  • For data from Elastic APM Node.js agents (where agent.name is nodejs).
  • Models the duration of spans.
  • Detects spans that are taking longer than usual to process.
abnormal_trace_durations_nodejs
  • For data from Elastic APM Node.js agents (where agent.name is nodejs).
  • Models the duration of trace transactions.
  • Detects trace transactions that are processing slower than usual.
decreased_throughput_nodejs
  • For data from Elastic APM Node.js agents (where agent.name is nodejs).
  • Models the transaction rate of the application.
  • Detects periods during which the application is processing fewer requests than normal.

RUM Javascript

edit

Detect problematic spans and identify user agents that are potentially causing issues. These configurations are only available if data exists that matches the recognizer query specified in the manifest file.

abnormal_span_durations_jsbase
  • For data from Elastic APM RUM JavaScript agents (where agent.name is js-base).
  • Models the duration of spans.
  • Detects spans that are taking longer than usual to process.
anomalous_error_rate_for_user_agents_jsbase

This job can help detect browser compatibility issues.

  • For data from Elastic APM RUM JavaScript agents (where agent.name is js-base).
  • Models the error rate of user agents.
  • Detects user agents that are encountering errors at an above normal rate.
decreased_throughput_jsbase
  • For data from Elastic APM RUM JavaScript agents or Elastic APM Node.js agents (where agent.name is js-base).
  • Models the transaction rate of the application.
  • Detects periods during which the application is processing fewer requests than normal.
high_count_by_user_agent_jsbase

This job is useful in identifying bots.

  • For data from Elastic APM RUM JavaScript agents (where agent.name is js-base).
  • Models the request rate of user agents.
  • Detects user agents that are making requests at a suspiciously high rate.

Transactions

edit

Detect anomalies in transactions from your APM services. These configurations are only available if data exists that matches the following term query: "processor.event": "transaction".

high_mean_transaction_duration
  • For transaction data where processor.event is transaction.
  • Models duration of transactions by transaction type for APM services.
  • Detects anomalies in high mean of transaction duration.